CVE-2019-4752 SQL injection in Emptoris Spend Analysis

What is CVE-2019-4752?

CVE-2019-4752 is a high-severity SQL injection vulnerability in IBM Emptoris Spend Analysis, published on 20 Feb 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Emptoris Spend Analysis and IBM Emptoris Strategic Supply Management Platform 10.1.0.x, 10.1.1.x, and 10.1.3.x is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 173348.

Weakness: CWE-89

Which versions are affected by CVE-2019-4752?

It affects 2 products.

Products include Ibm Emptoris Spend Analysis, Ibm Emptoris Strategic Supply Management Platform.

How do I fix CVE-2019-4752?

No fix has been published for CVE-2019-4752 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2019-4752 being exploited?

There is no known exploitation of CVE-2019-4752 in the wild and no public exploit code.

Other vulnerabilities in IBM Emptoris Spend Analysis

• CVE-2014-3061 Cross-site request forgery in n/a Medium 6.8
• CVE-2019-4482 Cross-site scripting in Emptoris Spend Analysis Medium 5.4
• CVE-2017-1445 Cross-site scripting in Emptoris Spend Analysis Medium 5.4
• CVE-2017-1446 Cross-site scripting in Emptoris Spend Analysis Medium 5.4
• CVE-2014-3035 Cross-site scripting in n/a Low 3.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8j42-mv6v-2hw2.