CVE-2008-0244

EPSS 80.3%

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/4877unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://aluigi.altervista.org/adv/sapone-adv.txt http://secunia.com/advisories/28409 http://securityreason.com/securityalert/3536 https://exchange.xforce.ibmcloud.com/vulnerabilities/39573 https://www.exploit-db.com/exploits/4877 http://www.securityfocus.com/archive/1/486039/100/0/threaded http://www.securityfocus.com/bid/27206 http://www.securitytracker.com/id?1019171 http://www.vupen.com/english/advisories/2008/0104