Jumis accounting software fixed sysadmin password on SQL Server
The Jumis server holding accounting books can be broken into!
Summary
Jumis accounting software derives its SQL Server sysadmin login password from the server name, so anyone can compute it and log in. A successful login gives full access to every customer's accounting database on that server.
Affected when
- Jumis SQL Server reachable over the network
- xp_cmdshell enabled on on-premise server installs (for OS command execution)
What to do
Update to TJ7.0.141.36 or later. No stopgap is given in the sources.
Products and platforms
CVE IDs
Sources
- Write-up: offseq.com (opens in a new tab)
Times
First published
First seen