Product: Procapita (school administration system)
Vendor: TietoEnator Abp
Vulnerable versions: unknown
Found: months ago
The program also contains other SQL injection vulnerabilities in text fields etc. accessible after login - especially ones that are used to search for information, which may allow compromise of sensitive personal information in the database via injection to a SELECT query.
The program prints exception handlers to the browser, including Oracle database error strings.
The session cookie lacks the 'secure' flag, and if a logged-in user clicks a link with the http: scheme (such links exist in the school district's web pages) the cookie will be sent in plain text.
The session cookie is not tied to the visitor's IP address.
The program gives the user no way of changing the password or disabling the login. The un-changeable password generated by the system is alphanumeric and only six characters.
The versioning of the program is so vague (the pages have either no version information at all or conflicting information) that it is impossible to say which versions are vulnerable, especially since I have no access to multiple installations, any docs or source.
The vulnerabilities have been reported to the vendor when they were found.
Exploits: None known
Fix: Modify code to properly sanitize user input server side.