Simmeth vulnerabilities
We track 4 vulnerabilities in Simmeth products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 25, 2022.
Latest Simmeth vulnerabilities
- 7.5 High severity
Lieferantenmanager: Session Fixation
An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after the victim logged out - /LMS/LM/#main can be used for this. This is due to the credentials not being c
- 7.5 High severity
Lieferantenmanager: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LM_API/api/ConfigurationService/GetImages with an '"ImagesPath":"C:\\"' value.
- 9.8 Critical severity
Lieferantenmanager: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xp_cmdshell extended procedure.
- 9.1 Critical severity
Lieferantenmanager: Missing Authentication for Critical Functionality
An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authentication because the password in a Credential Object is not checked.