Isma Khan has reported a vulnerability in HP Mercury Quality Center, which can be exploited by malicious users to manipulate certain data.

The problem is that the "RunQuery()" method can be used by authenticated users to execute certain SQL commands when making POST requests to qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment. This can be exploited to e.g. delete users or update user information in the USER table via specially crafted POST requests.

The vulnerability is reported in version 9.0 build 9.1.0.4352. Other versions may also be affected.

Solution
Grant only trusted users access to the application.

Provided and/or discovered by
Isma Khan

Changelog
Further details available in Customer Area

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053406.html

Deep Links
Links available in Customer Area