The application is vulnerable to blind SQL injection which is exploitable through /webservice/clienttools/services/mdownload.php. This issue is exploitable without authentication.
The vulnerable code is in the get_active_session function in the KTAPI_UserSession class. In this location the query isn't parameterized when looking up the active session. In the getFileName function an unvalidated 'u' parameter is passed.
Exploitable from:
/webservice/clienttools/services/mdownload.php
POC is withheld.
The CVE project assigned CVE-2014-2737 to this issue.
Vendor Response:
February 25, 2014, Vulnerability identified
February 25, 2014, Product vendor notification
March 14, 2014, Vendor confirmed the issue
March 26, 2014, Vendor fix reviewed
March 28, 2014, Vendor fix confirmed
March 28, 2014, Vendor has a patch available for the open source product
April 20, 2014, Disclosure
Craig Arendt, Stratum Security
http://www.stratumsecurity.com
Disclaimer:
The information provided in this advisory is provided as is without warranty of any kind.