Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86369057

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS) 
# Date: [12/21/2022 02:07:23 AM UTC]
# Exploit Author: [geeklinuxman@gmail.com]
# Vendor Homepage: [https://www.red-gate.com/]
# Software Link: [https://www.red-gate.com/products/dba/sql-monitor/]
# Version: [SQL Monitor 12.1.31.893]
# Tested on: [Windows OS]
# CVE : [CVE-2022-47870]

 [Description]
 Cross Site Scripting (XSS) in the web SQL monitor login page in Redgate
 SQL Monitor 12.1.31.893 allows remote attackers to inject arbitrary web
 Script or HTML via the returnUrl parameter.

 [Affected Component] affected returnUrl in
https://sqlmonitor.*.com/Account/Login?returnUrl=&hasAttemptedCookie=True
 affected A tag under span with "redirect-timeout" id value

 [CVE Impact]
 disclosure of the user's session cookie, allowing an attacker to
hijack the user's session and take over the account.

 [Attack Vectors]
 to exploit the vulnerability, someone must click on the malicious A
HTML tag under span with "redirect-timeout" id value

 [Vendor]
 http://redgate.com
 http://sqlmonitor.com
 https://sqlmonitor.