San Antonio, TX – May, 16, 2012 – Digital Defense, Inc., a leading provider of managed cloud-based security assessments, announced the organization’s discovery of a blind SQL injection vulnerability in the Epicor Returns Management software SOAP interface. Left unremediated, this vulnerability could potentially be leveraged by an attacker to execute arbitrary SQL commands and extract information from the backend database using standard SQL exploitation techniques. Additionally, an attacker may be able to exploit this flaw to compromise the database server host operating system.
Digital Defense followed their ethical disclosure policy, which included the immediate notification of Epicor Software Corporation. Epicor has now confirmed that they have contacted the customers affected and have made an update available to address this vulnerability. Epicor has also advised Digital Defense that the codebase for Returns Management software might differ significantly from customer to customer, and has suggested that some customer installs may not contain this specific vulnerability due to this codebase variability. Digital Defense recommends that any customer currently utilizing Epicor Returns Management software within their enterprise install the update Epicor has made available and, if concerned, log a support call with Epicor directly to determine if their codebase contains this vulnerability.
Larry Hurtado, Digital Defense President & CEO, states, “Digital Defense has emerged as an industry leader in the disclosure of zero day vulnerabilities. Our Collective Security Intelligence, offered through our cloud-based platform, provides our clients an extra measure of peace of mind knowing that our technology and expertise result in the rapid identification of vulnerabilities, which may otherwise go undetected. We responsibly communicate vulnerability information to clients, vendors, and ultimately the public so that remediation solutions can be developed quickly and effectively.”