Brilliance Golden Link Secondary System SQL Injection Vulnerability in rentTakeInfoPage.htm

A critical SQL injection vulnerability has been identified in the Brilliance Golden Link Secondary System, affecting versions prior to 20250609. The issue arises in the file /storagework/rentTakeInfoPage.htm, where the argument custTradeName can be manipulated to inject SQL commands. This vulnerability can be exploited remotely, and details of the exploit have been publicly disclosed.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

The vulnerability can be reproduced by sending a request to the rentTakeInfoPage.htm file with a crafted custTradeName parameter that includes SQL injection payloads. This can be done manually or automated with a script, such as one using Python's requests library. The injection point can be identified by searching for the file in vulnerable applications.