CVE-2018-1000558

Vulnerability

SQL injection flaws exist in ocsreports versions 2.3.1 and 2.4. The vulnerability is present in the visu_search function via the value GET parameter in index.php, and in the visu_groups function via the columns[0][name] POST parameter in ajax.php [1]. The application fails to sanitize user-supplied input before including it in SQL queries.

Exploitation

An authenticated user (even with read-only privileges) can exploit the SQLi by sending crafted requests. For example, using sqlmap, the value parameter in index.php?function=visu_search&prov=allsoft&value=somesoft was exploited with boolean-based blind and time-based blind techniques [1]. Similarly, the columns[0][name] parameter in ajax.php is injectable. No special network position is required beyond network access to the OCS reports web interface.

Impact

Successful exploitation allows an authenticated attacker to gain full read access to all data stored in the OCS Inventory database, including sensitive inventory information. The blind injection can be used to extract data from all tables. Write operations (e.g., INSERT, UPDATE) are not mentioned, but the attacker can enumerate and extract any database content [1].

Mitigation

The vulnerability is fixed in ocsreports version 2.4.1, released in early 2018 [1]. Users should upgrade to 2.4.1 or later. As of the advisory, older versions including 2.3.1 and 2.4 remain vulnerable and no workaround is provided. The vendor announced the release on their site [1]. Not listed in CISA KEV.