Vulners
Lucene search
SAP MaxDB 7.6.03.07 - Remote Command Execution
| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
 | SAP DB / MaxDB Cons Program Arbitrary Command Execution | 11 Jan 200800:00 | – | nessus |
| SAP MaxDB Multiple Vulnerabilities | 5 May 200800:00 | – | nessus |
| SAP DB / MaxDB Cons Program Arbitrary Command Execution | 11 Jan 200800:00 | – | nessus |
| SAP MaxDB Multiple Vulnerabilities | 9 May 200800:00 | – | nessus |
 | CVE-2008-0244 | 29 May 201815:50 | – | circl |
 | SAP MaxDB Remote Arbitrary Commands Execution (CVE-2008-0244) | 29 Oct 200900:00 | – | checkpoint_advisories |
 | CVE-2008-0244 | 12 Jan 200802:00 | – | cve |
 | CVE-2008-0244 | 12 Jan 200802:00 | – | cvelist |
 | DSquare Exploit Pack: D2SEC_MAXDB | 12 Jan 200802:46 | – | d2 |
 | SAP MaxDB cons.exe Remote Command Injection | 20 Jan 200822:52 | – | metasploit |
10
#######################################################################
Luigi Auriemma
Application: SAP MaxDB
https://www.sdn.sap.com/irj/sdn/maxdb
http://www.sap.com
Versions: <= 7.6.03 build 007
Platforms: Windows, Linux and Solaris
Bug: pre-auth remote commands execution
Exploitation: remote
Date: 09 Jan 2008
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
SAP MaxDB is a commercial and widely known and used database.
#######################################################################
======
2) Bug
======
The MaxDB server executes "cons.exe DATABASE COMMAND" through system()
when some special commands are called by the user.
Some of these special commands are "show" and "exec_sdbinfo" and this
last one is just one of the small amount of commands which can be
executed by the unauthenticated users before logging in.
The usage of system() for executing the cons program allows an external
unauthenticated attacker to execute any command he wants on the target
SAP MaxDB server simply passing the "&&" or other patterns for the
execution of multiple commands in the shell.
So it's just enough to use the following SAP command to see the content
of C: on Windows (the bug is naturally exploitable on any other
platform supported by the server):
exec_sdbinfo && echo dir c:\ | cmd.exe
Then the rest and all the other possibilities of exploiting this
vulnerability are in the fantasy of the attacker...
#######################################################################
===========
3) The Code
===========
http://aluigi.org/poc/sapone.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4877.zip (2008-sapone.zip)
#######################################################################
======
4) Fix
======
No fix
#######################################################################
# milw0rm.com [2008-01-09]Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
09 Jan 2008 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 210
EPSS0.80311