cbcvebase.
CVE-2017-6550
published 2017-03-20

CVE-2017-6550: Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands via the (1) TABLE…

PriorityP268critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
3.97%
89.2th percentile
Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands via the (1) TABLE parameter to esbus/servlet/GetSQLData or (2) QUERY parameter to KK_LS9ReportingPortal/GetData.

Detection & IOCsextracted from sources · hover to see the quote

url/esbus/servlet/GetSQLData?SCHEMA=ESBUS_INTERNAL&TABLE=SCHEDULEDTASKS UNION ALL SELECT >&FIELD=LASTRUN&NOHEADER=1&SELECT=CLASS=com.esbus.appliance.SOD_PolicyCheck_SystemRun_TimerTask&OUT=XML↗
url/KK_LS9ReportingPortal/GetData?SERVERID=%27;LSF_PROD&↗
path/esbus/servlet/GetSQLData↗
path/KK_LS9ReportingPortal/GetData↗
commandQUERY=1 AND SLEEP(5) AND ('foo'='foo'))↗
  • →Detect SQL injection attempts against the TABLE parameter in GET requests to /esbus/servlet/GetSQLData, specifically looking for UNION ALL SELECT payloads. ↗
  • →Detect time-based blind SQL injection via POST body QUERY parameter to /KK_LS9ReportingPortal/GetData, specifically SLEEP() function calls. ↗
  • →Detect SQL injection in the SERVERID URL parameter to /KK_LS9ReportingPortal/GetData, specifically single-quote and semicolon injection patterns (e.g., %27;). ↗
  • →Monitor for JSP webshell creation or new .jsp file writes under the /esbus/ web directory following exploitation. ↗
  • ·The vulnerability affects ALL versions of Kinsey Infor-Lawson (ESBUS), so version-based filtering or allowlisting is not a viable mitigation. ↗
  • ·The exploit was tested on Windows Server 2008 R2 with MySQL 5.5; detection logic (e.g., SLEEP-based SQLi) may need adjustment for other database backends. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.