SAP MaxDB 'cons.exe' Remote Command Injection Vulnerability
BID:27206
Info
SAP MaxDB 'cons.exe' Remote Command Injection Vulnerability
| Bugtraq ID: | 27206 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-0244 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 09 2008 12:00AM |
| Updated: | Feb 09 2010 05:51AM |
| Credit: | Luigi Auriemma discovered this vulnerability. |
| Vulnerable: |
SAP MaxDB 7.6.3 build 007 |
| Not Vulnerable: | |
Discussion
SAP MaxDB 'cons.exe' Remote Command Injection Vulnerability
SAP MaxDB is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input.
Successfully exploiting this issue allows remote attackers to execute arbitrary shell commands with the privileges of the database server. Multiple database commands expose this issue, including one that is available prior to authentication.
MaxDB 7.6.03 build 007 is vulnerable to this issue; other versions may also be affected.
SAP MaxDB is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input.
Successfully exploiting this issue allows remote attackers to execute arbitrary shell commands with the privileges of the database server. Multiple database commands expose this issue, including one that is available prior to authentication.
MaxDB 7.6.03 build 007 is vulnerable to this issue; other versions may also be affected.
Exploit / POC
SAP MaxDB 'cons.exe' Remote Command Injection Vulnerability
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploit example is available:
exec_sdbinfo && echo dir c:\ | cmd.exe
The following exploit code is available:
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploit example is available:
exec_sdbinfo && echo dir c:\ | cmd.exe
The following exploit code is available:
Solution / Fix
SAP MaxDB 'cons.exe' Remote Command Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
SAP MaxDB 'cons.exe' Remote Command Injection Vulnerability
References:
References:
- SAP MaxDB Homepage (SAP)
- Pre-auth remote commands execution in SAP MaxDB 7.6.03.07 (Luigi Auriemma