Detections
Analytics
SAP DB / MaxDB Cons Program Arbitrary Command Execution
high Nessus Plugin ID 29924
Language:
Synopsis
The remote database service allows execution of arbitrary commands.Description
The version of SAP DB / MaxDB installed on the remote host fails to sanitize user-supplied input to the 'show' and 'exec_sdbinfo' commands before passing it to a 'system()' call. An unauthenticated, remote attacker can leverage this issue to execute arbitrary commands on the affected host subject to the privileges under which the service operates, which under Windows is SYSTEM.Solution
Upgrade to MaxDB version 7.6.03 Build 15 (7.6.03.15) or later.See Also
https://seclists.org/bugtraq/2008/Jan/102
https://www.sdn.sap.com/irj/sdn/thread?threadID=697805&tstart=50
http://maxdb.sap.com/webpts/?wptsdetail=yes&ErrorType=0&ErrorID=1152820
Plugin Details
Severity: High
ID: 29924
File Name: sapdb_cons_cmd_exec.nasl
Version: 1.26
Type: remote
Family: Databases
Published: 1/11/2008
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 8.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:sap:maxdb
Exploit Available: true
Exploit Ease: Exploits are available
Exploited by Nessus: true
Exploitable With
CANVAS (D2ExploitPack)
Core Impact
Reference Information
CVE: CVE-2008-0244
BID: 27206