Description
JIWA Financials 6.4.14 stores usernames and passwords for all accounts in cleartext in the HR_Staff table in Microsoft SQL Server, and sends the usernames and passwords in cleartext to the application's SQL Server ODBC driver, which might allow context-dependent attackers to obtain the passwords.
References
- 1016181 vdb-entry
- 20060530 Jiwa Financials - Reporting allows execution of arbitrary reports as SQL user with full permissions. mailing-list
- 20060529 Jiwa Financials - Reporting allows execution of arbitrary reports as SQL user with full permissions. mailing-list
- 20342 third-party-advisory
- 1000 third-party-advisory