Polaris’ Intellect Core Banking Software Version 9.7.1- Open Redirect [CVE-2018-14931]


[+] Credits: Neeraj Kumar, Hai Dang Long
[+] Email: neeraj.iiita2009@gmail.com

Vendor:
====================

Product:
===================
Polaris’ Intellect Core Banking, Core and Portal Module

Version:
===================
Affected Version: 9.7.1

Vulnerability Type:
====================
Open Redirect

CVE Reference:
==============
CVE-2018-14931

Vulnerability Details:
======================
Polaris’ Intellect Core Banking Software, In the Core module is vulnerable to open redirect vulnerability. Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application which causes a redirection to an arbitrary external domain. This behaviour can be leveraged to facilitate phishing attacks against users of the application. The ability to use an authentic application URL, targeting the correct domain with a valid SSL certificate (if SSL is used) lends credibility to the phishing attack because many users, even if they verify these features, will not notice the subsequent redirection to a different domain.

Exploit URL(s):
====================
http://<targetIP>/IntellectMain.jsp?IntellectSystem=https://google.com
It ill redirect to http://www.google.com

Affected Component:
====================
Parameters Name: IntellectSystem

Disclosure Timeline:
=====================
Vendor Notification: 17 June 2018
Mitre Notification: 04 August 2018
Public Disclosure: 31 March 2019

Attack Type:
=====================
Remote

Impact Code execution:
=====================
True

Impact Information Disclosure
=====================
True

Description:
=====================================================
Request Method(s): [+] Get
Vulnerable Product: [+] Polaris’ Intellect Core Banking, Core and Portal Modules
Vulnerable Parameter(s): [+] IntellectSystem
[+] Disclaimer
=====================================================
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. All content (c).

Comments

  1. keep up the good work. this is an Assam post. this to helpful, i have reading here all post. i am impressed. thank you. this is our digital marketing training center. This is an online certificate course
    digital marketing training in bangalore | https://www.excelr.com/digital-marketing-training-in-bangalore

    ReplyDelete
  2. Love your website. Keep up the good work.
    To get more Branding updates visit our
    brandebuzz.com website Smart Branding Solutions in Hyderabad

    ReplyDelete
  3. I came across your website. It’s awesome, dude. I told my brother about it. He’s bookmarked your site.
    To get more Branding updates visit our
    brandebuzz.com website Smart Branding Solutions in hyderabad

    ReplyDelete
  4. Great share!,
    To get more Branding updates visit our
    brandebuzz.com website Smart Branding Solutions

    ReplyDelete
  5. I was very pleased to find this great site. I need to to thank you for ones time for this fantastic read!! I definitely appreciated every part of it and i also have you book-marked to see new stuff on your web site.
    Tech PC

    ReplyDelete


  6. This post is really nice and informative. The explanation given is really comprehensive and informative. I also want to say about the digital marketing training .

    ReplyDelete
  7. Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. data analytics courses

    ReplyDelete
  8. I just got to this amazing site not long ago. I was actually captured ExcelR Pune Digital Marketing Course with the piece of resources you have got here. Big thumbs up for making such wonderful blog page!

    ReplyDelete
  9. Cool stuff you have and you keep ExcelR Digital Marketing Classes In Pune overhaul every one of us

    ReplyDelete
  10. The concept has been explained very well. Gained clear knowledge about the prominence of AWS
    AWS Training in Hyderabad

    ReplyDelete
  11. Thank you for sharing this useful post with us. I have a nutrition & health-related website. I'm telling you about this beautiful topic and this topic is a core training. Core training is very impotent part for every human. I have a website and this website discusses human body fitness and nutrition. Read more please visit this website.

    ReplyDelete
  12. You have provided very good information through blog and it is very important. Thank you so much.
    Blockchain Training in Hyderabad

    ReplyDelete
  13. Great article like this require readers to think as they read. I took my time when going through the points made in this article. I agree with much this information.
    Best Data Science training in Mumbai

    Data Science training in Mumbai


    ReplyDelete
  14. Thanks for sharing such a informative blog with us. Keep on sharing
    DevOps Training In Hyderabad

    ReplyDelete

  15. You have provided very good information through blog and it is very important.
    Blockchain Training in Hyderabad

    ReplyDelete
  16. I’m impressed, I must say. Seldom do I come across a blog that’s both educative and interesting, and without a doubt, you have hit the nail on the technology head. The problem is an issue that not enough folks are speaking intelligently about. Now i'm very happy I stumbled across this during my hunt for something regarding this.

    ReplyDelete
  17. Thanks for the informative article About Java. This is one of the best resources I have found in quite some time. Nicely written and great info. I really cannot thank you enough for sharing.
    Java training in chennai | Java training in annanagar | Java training in omr | Java training in porur | Java training in tambaram | Java training in velachery

    ReplyDelete
  18. thanks for sharing nice information. its Very use full and informative and keep sharing.
    more : https://www.analyticspath.com/artificial-intelligence-training-in-hyderabad

    ReplyDelete
  19. thanks for sharing nice information. its Very use full and informative and keep sharing.
    more : https://www.kellytechno.com/Hyderabad/Course/AI-Training-In-Hyderabad

    ReplyDelete
  20. Excellent Blog! I would like to thank for the efforts you have made in writing this post. I am hoping the same best work from you in the future as well. I wanted to thank you for this websites! Thanks for sharing. Great websites!

    data science course

    ReplyDelete
  21. I am speechless as to how great this article is. The content is simple to understand and very engaging. This is by far some of the best content I've seen.
    SAP training in Kolkata
    SAP training Kolkata
    Best SAP training in Kolkata
    SAP course in Kolkata
    SAP training institute Kolkata

    ReplyDelete
  22. These ways are very simple and very much useful, as a beginner level these helped me a lot thanks fore sharing these kinds of useful and knowledgeable information.
    Banking Chatbot
    Bank Bot
    AI Chatbot for Banking
    Bank Chatbot

    ReplyDelete
  23. Great Article
    Cloud Computing Projects


    Networking Projects

    Final Year Projects for CSE


    JavaScript Training in Chennai

    JavaScript Training in Chennai

    The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

    ReplyDelete
  24. Really Very Infromative Post , Thanks For Sharing The Information With Us.
    Best AWS Training Institute in Hyderabad

    ReplyDelete
  25. Thank you so much for this incredible guide. This has given me so much information
    AI Training in Hyderabad

    ReplyDelete
  26. Attend The Data Analyst Course From ExcelR. Practical Data Analyst Course Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Analyst Course.
    Data Analyst Course

    ReplyDelete
  27. This is truly unique and excellent information. I sense you think a lot like me, or vice versa. Thank you for sharing this great article.
    SAP training in Kolkata
    SAP training Kolkata
    Best SAP training in Kolkata
    SAP course in Kolkata

    ReplyDelete
  28. I am highly overwhelmed to read this perfect piece of writing. It has really enthused me to read more on this topic.
    Data Science training in Mumbai
    Data Science course in Mumbai
    SAP training in Mumbai

    ReplyDelete
  29. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article. This article inspired me to read more. keep it up.

    AWS Training in Hyderabad

    ReplyDelete
  30. Howdy! I simply wish to offer you a big thumbs up for your great info you have got here on this post. I'll be returning to your blog for more soon.

    Data Science Training in Hyderabad

    ReplyDelete
  31. I am looking for and I love to post a comment that "The content of your post is awesome" Great work!

    Simple Linear Regression

    Correlation vs covariance

    KNN Algorithm

    Logistic Regression explained

    ReplyDelete
  32. I am looking for and I love to post a comment that "The content of your post is awesome" Great work!

    data science interview questions

    ReplyDelete
  33. Astogurutips is the top best Online Astrology website in India with more than 500+ astrologer on the portal. He gives a Best Astrology solutions from the Best Astrologers . You can connect with our astrologer through call or chat and ask you any question about your carrier, health, future, love partner etc. Free astrology service on phone

    ReplyDelete
  34. very well explained .I would like to thank you for the efforts you had made for writing this awesome article. This article inspired me to read more. keep it up.
    Simple Linear Regression
    Correlation vs covariance
    data science interview questions
    KNN Algorithm
    Logistic Regression explained

    ReplyDelete
  35. enterprise billing & pricing management solutions
    Personalize products, offers, pricing and loyalty programs; prevent revenue leakage and ensure regulatory compliance with an enterprise billing solution.


    ReplyDelete
  36. I am really happy to say it’s an interesting post to read . I learn new information from your article , you are doing a great job . Keep it up

    Devops Training in USA

    Hadoop Training in Hyderabad

    Python Training in Hyderabad

    ReplyDelete
  37. Well Explained Content thanks For Sharing The Information With Us data science training in Hyderabad

    ReplyDelete
  38. Great information about wilderness for beginners giving the opportunity for new people. Gaming Jackets

    ReplyDelete
  39. Thanks for sharing..
    Cybonetic Technologies IT & Software Development Company in Patna, focusing on the development of software, mobile app, e-comm, web hosting, bulk sms, Digital Marketing services.

    ReplyDelete
  40. I really appreciate the kind of topics you post here. Thanks for sharing us a great information that is actually helpful.
    george michael leather jacket

    ReplyDelete
  41. This was definitely one of my favorite blogs. Every post published did impress me. ExcelR Data Analytics Course

    ReplyDelete
  42. Wonderful blog found to be very impressive to come across such an awesome blog. I should really appreciate the blogger for the efforts they have put in to develop such an amazing content for all the curious readers who are very keen of being updated across every corner. Ultimately, this is an awesome experience for the readers. Anyways, thanks a lot and keep sharing the content in future too.

    Digital Marketing training in Bhilai

    ReplyDelete
  43. Wow such an amazing content keep it up. I have bookmarked your page to check out more informative content here.

    SASVBA provides professional AI training course in Delhi with the help of industry experts. Artificial intelligence is a method of building a computer-controlled robot, computer, or software that thinks wisely as well as intelligently. It is science and technology-based on subjects such as computer science, biology, psychology, linguistics, mathematics, and engineering.

    FOR MORE INFO:

    ReplyDelete
  44. valuable blog,Informative content...thanks for sharing, Waiting for the next update...
    Silk Test Course in Chennai
    Silk Test Classes in Chennai

    ReplyDelete
  45. I read your article it is very interesting and every concept is very clear, thank you so much for sharing. AWS Certification Course in Chennai

    ReplyDelete
  46. Hey, I agree with you and i have same dilemma. After reading your posts I went back in and I set my discussions such that now all my requirements related to banking software development company. This is really awesome but that's why you always crank out my friend. Great posts about Restaurant Order Management System that we can sink our teeth into and really go to work.

    Thanks for sharing, as otherwise i would not have thought about trying IT consulting companies in NYC.

    ReplyDelete
  47. Once again you provide several doses of reality which explore the complete explanation of packing and moving companies in Bangalore. This article don't have to be that long. I simply couldn't leave your web site before suggesting that I actually loved the usual info on packing and movers services in Bangalore.

    ReplyDelete
  48. Thanks for posting the best information and the blog is very important.artificial intelligence course in hyderabad

    ReplyDelete
  49. core banking platform
    With SunTec Ecosystem Management, co-innovate and create solutions which solve specific customer lifecycle needs.

    ReplyDelete
  50. Stupendous blog huge applause to the blogger and hoping you to come up with such an extraordinary content in future. Surely, this post will inspire many aspirants who are very keen in gaining the knowledge. Expecting many more contents with lot more curiosity further.

    Data Science Certification in Bhilai

    ReplyDelete
  51. Extraordinary blog went amazed with the content that they have developed in a very descriptive manner. This type of content surely ensures the participants to explore themselves. Hope you deliver the same near the future as well. Gratitude to the blogger for the efforts.

    Data Science Training

    ReplyDelete
  52. Impressive blog to be honest definitely this post will inspire many more upcoming aspirants. Eventually, this makes the participants to experience and innovate themselves through knowledge wise by visiting this kind of a blog. Once again excellent job keep inspiring with your cool stuff.

    Data Science Training in Bhilai

    ReplyDelete
  53. Wonderful blog found to be very impressive to come across such an awesome blog. I should really appreciate the blogger for the efforts they have put in to develop such an amazing content for all the curious readers who are very keen of being updated across every corner. Ultimately, this is an awesome experience for the readers. Anyways, thanks a lot and keep sharing the content in future too.

    Data Science Course in Bhilai

    ReplyDelete
  54. Thanks for bringing such innovative content which truly attracts the readers towards you. Certainly, your blog competes with your co-bloggers to come up with the newly updated info. Finally, kudos to you.

    Data Science Course in Varanasi

    ReplyDelete
  55. It's actually a great and helpful piece of information. I am satisfied that you just shared this useful information for us.
    Indian Freeway Jacket

    ReplyDelete
  56. Our team of experts develops tailored and device-based solutions that help the end-to - end student learning process at reasonable rates. We do provide learners app and app for teachers with simple-to-use features, multi - channel access, and multi-level analytic tools.
    https://lilacinfotech.com/what-we-do/e-learning-educational-on-demand-app-development-india

    ReplyDelete
  57. This is great collection of shotguns at British shooting show. Drive Scorpion Jacket

    ReplyDelete
  58. banking software
    Personalize products, offers, pricing and loyalty programs; prevent revenue leakage and ensure regulatory compliance with a billing solution.

    ReplyDelete
  59. Thanks for posting the best information and the blog is very good.data science course in Lucknow

    ReplyDelete
  60. Nice post and thanks for sharing. keep going

    Are you searching for any inexpensive billing software in Chennai? We are here

    Billing Software in Chennai
    Restaurant Billing Software in Chennai

    ReplyDelete
  61. Amazingly by and large very interesting post. I was looking for such an information and thoroughly enjoyed examining this one. Keep posting. An obligation of appreciation is all together for sharing.data scientist course in bhubaneswar

    ReplyDelete
  62. Thanks for sharing this.,
    Leanpitch provides online training in Scrum Master, everyone can use it wisely.
    Join Leanpitch 2 Days CSM Certification Workshop in different cities.

    Scrum master certification
    csm certification

    ReplyDelete

  63. Excellent content ,Thanks for sharing this .,
    Leanpitch provides online training in ICP ACC, everyone can use it wisely.

    Agile coach certification
    ICP ACC certification

    ReplyDelete
  64. pricing management software for banking
    Personalize products, offers, pricing and loyalty programs; prevent revenue leakage and ensure regulatory compliance with a billing solution.

    ReplyDelete
  65. Great blog. You will find the loan application process effortless, convenient, and easy with Bhumi Finance. So, it allows you to fulfill your pre-owned car loan requirements and celebrate with your family without holding back. You can Business Loan Agents in Varanasi at any time via the website.

    ReplyDelete
  66. It is extremely nice to see the greatest details presented in an easy and understanding manner.
    data science course in hyderabad

    ReplyDelete
  67. İnstagram takipçi satın al! İnstagram takipçi sitesi ile takipçi satın al sende sosyal medyada fenomen olmaya bir adım at. Sende hemen instagram takipçi satın almak istiyorsan tıkla:

    1- takipçi satın al

    2- takipçi satın al

    3- takipçi satın al

    ReplyDelete
  68. That is nice article from you , this is informative stuff . Hope more articles from you . I also want to share some information about micro nutrient for plant growth

    ReplyDelete
  69. I finally found great post here.I will get back here. I just added your blog to my bookmark sites. thanks.Quality posts is the crucial to invite the visitors to visit the web page, that's what this web page is providing.data science course in rohtak

    ReplyDelete
  70. We are looking for an informative post it is very helpful thanks for sharing it. We are offering all types of leather jackets with worldwide free shipping.
    Black Leather Jacket
    Leather Bomber Jacket
    Mens Biker Leather Jacket
    Western Leather Jackets

    ReplyDelete
  71. I have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.

    Great information.Thanks for sharing the article
    Data science course in hyderabad
    Data science training in hyderabad

    ReplyDelete
  72. This post is very simple to read and appreciate without leaving any details out. Great work!data science course in chennai

    ReplyDelete
  73. I have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.


    Data science course in hyderabad
    Data science training in hyderabad

    ReplyDelete
  74. Your internet site is in fact cool and this is a pleasant challenging article. thank you this is excellent blog. Facebook ID Password Hacker Software

    ReplyDelete
  75. Please proportion extra considering that. New net web site is calling high-quality. thanks for the pleasant effort. Recuva Crack

    ReplyDelete
  76. Thanks for sharing a valuable information.All is very fascinating to learn and simple to grasp. Thanks for sharing such great info. Keep Post These kinds of Articles in the future.
    Home
    fashion designing course in chennai
    interior designing course in chennai
    web & graphic designing course in chennai
    jewelry designing course in chennai
    About us

    ReplyDelete
  77. It is very interesting! Really useful for me and thank you for this amazing blog.
    Virginia Military Divorce

    ReplyDelete
  78. It is very useful for me and thank you so much for your sharing this post. Keep updating...
    Separation Before Divorce
    Cost of Legal Separation VS Divorce
    Online Solicitation Of A Minor

    ReplyDelete
  79. This indeed a very informative and educative post. One thing is for sure you’ll never run out of content. Honestly this post will obviously help a lot of people on what makes up good content and how to structure it for the best result. 
    eCommerce website development in USA

    ReplyDelete

Post a Comment

Popular posts from this blog

Stored XSS Vulnerability in Hot Scripts Clone:Script Classified Version 3.1-[CVE-2018-7650]

SQL Injection With File Upload