NewType WebEIP v3.0 - SQL injection

Vulnerability

NewType WebEIP v3.0 fails to properly validate user input, leading to a SQL injection vulnerability [1][2]. Any remote attacker with regular user privileges can inject arbitrary SQL commands into database queries. The affected product is end-of-life and no longer maintained by the vendor, who recommends upgrading to WebEIP Pro [1][2].

Exploitation

An attacker needs only network access to the WebEIP v3.0 application and a valid low-privileged account. No user interaction or additional privileges are required. By crafting malicious input in a parameter that is passed unsanitized to an SQL query, the attacker can execute arbitrary SQL statements [1][2].

Impact

Successful exploitation allows the attacker to read, modify, and delete any data stored in the underlying database [1][2]. This leads to full compromise of confidentiality, integrity, and availability of the application's data, with a CVSS score of 8.8 (High) [1][2].

Mitigation

NewType WebEIP v3.0 has been discontinued and is no longer supported; no patch will be provided [1][2]. Organizations must upgrade to the vendor's current product, WebEIP Pro, to eliminate the vulnerability [1][2].