Some vulnerabilities have been reported in SolarWinds Network Performance Monitor, which can be exploited by malicious people to conduct script insertion, cross-site request forgery attacks, and SQL injection attacks.

1) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. add a user of the application when a logged-in administrative user visits a specially crafted web page.

2) Input passed via the "syslocation", "syscontact", and "sysName" attributes within a snmpd.conf file is not properly sanitised before being used after a scan. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

3) Certain unspecified input via Orion NPM and Orion Core is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities are reported in versions prior to 10.3.1. Other versions may also be affected.

Solution
Update to version 10.3.1.

Provided and/or discovered by
1, 2) muts, Offensive Security via US-CERT.
3) The vendor credits Javier Castro, Digital Defense.

Changelog
Further details available to Secunia VIM customers

Original Advisory
SolarWinds:
http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm

muts:
http://www.exploit-db.com/exploits/20011/

US-CERT:
http://www.kb.cert.org/vuls/id/174119

Deep Links
Links available to Secunia VIM customers