Description
Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests. Attackers can exploit this vulnerability by crafting malicious POST requests with specially constructed SQL payloads that trigger database sleep functions to extract information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Vianeos | Vianeos OctoPUS | > V5 | — |
References
- ExploitDB-50078 exploit
- Vendor Homepage product
- Software Product Page product
- VulnCheck Advisory: Vianeos OctoPUS 5 - 'login_user' SQLi third-party-advisory