CVE-2008-0244

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in execsdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe...

Command injection

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in execsdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe...

DSquare Exploit Pack: D2SEC_MAXDB

Name| d2secmaxdb ---|--- CVE| CVE-2008-0244 Exploit Pack| D2ExploitPack Description| SAP MaxDB cons.exe Remote Command Injection Vulnerability Notes|...

CVE-2008-0244

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in execsdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe...

CVE-2008-0244

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in execsdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe...

CVE-2008-0244

SAP MaxDB is affected by a remote command-injection in the exec_sdbinfo handling that invokes cons.exe via system() without proper input validation. This allows unauthenticated remote attackers to execute arbitrary commands on MaxDB servers (MaxDB 7.6.x and earlier; vulnerability noted for 7.6.0....

CVE-2008-0244: Improper Input Validation

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in execsdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe...

SAP MaxDB cons.exe远程命令注入漏洞

BUGTRAQ ID: 27206 MaxDB是SAP应用中广泛使用的数据库管理系统。 MaxDB在处理用户请求数据时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 如果未经认证的远程攻击者执行了show或execsdbinfo等特殊命令的话，MaxDB服务器就会通过system执行cons.exe DATABASE COMMAND，而使用system执行cons程序允许外部攻击者通过传送&&或其他方式在服务器上执行任意命令。例如，可使用以下SAP命令查看Windows上C盘的内容： execsdbinfo && echo dir c:\ | cmd.exe SAP...

SAP DB / MaxDB Cons Program Arbitrary Command Execution

The version of SAP DB / MaxDB installed on the remote host fails to sanitize user-supplied input to the 'show' and 'execsdbinfo' commands before passing it to a 'system' call. An unauthenticated, remote attacker can leverage this issue to execute arbitrary commands on the affected host subject to...

SAP DB / MaxDB Cons Program Arbitrary Command Execution

Binary data 4337.prm...

SAP MaxDB <= 7.6.03.07 pre-auth Remote Command Execution Exploit

No description provided by source. Luigi Auriemma Application: SAP MaxDB https://www.sdn.sap.com/irj/sdn/maxdb http://www.sap.com Versions: = 7.6.03 build 007 Platforms: Windows, Linux and Solaris Bug: pre-auth remote commands execution Exploitation: remote Date: 09 Jan 2008 Author: Luigi Auriemm...

MaxDB Version Detection

Binary data 4336.prm...

Pre-auth remote commands execution in SAP MaxDB 7.6.03.07

Luigi Auriemma Application: SAP MaxDB https://www.sdn.sap.com/irj/sdn/maxdb http://www.sap.com Versions: = 7.6.03 build 007 Platforms: Windows, Linux and Solaris Bug: pre-auth remote commands execution Exploitation: remote Date: 09 Jan 2008 Author: Luigi Auriemma e-mail: [email protected] web:...

SAP MaxDB shell characters security vulnerability

Shell characters vulnerability on executing pre-authentication execsdbinfo command...

SAP MaxDB 7.6.03.07 - Remote Command Execution

SAP MaxDB 7.6.03.07 - Remote Command Execution Luigi Auriemma Application: SAP MaxDB https://www.sdn.sap.com/irj/sdn/maxdb http://www.sap.com Versions: = 7.6.03 build 007 Platforms: Windows, Linux and Solaris Bug: pre-auth remote commands execution Exploitation: remote Date: 09 Jan 2008 Author:...

SAP MaxDB <= 7.6.03.07 pre-auth Remote Command Execution Exploit

Exploit for multiple platform in category remote exploits ================================================================ SAP MaxDB = 7.6.03.07 pre-auth Remote Command Execution Exploit ================================================================ Luigi Auriemma Application: SAP MaxDB...

SAP MaxDB cons.exe Remote Command Injection

SAP MaxDB is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. Module Options msf use auxiliary/admin/maxdb/maxdb/consexec msf undefinedconsexec show actions ...actions... msf undefinedconsexec set ACTION msf undefinedconsexe...

SAP MaxDB 7.6.03.07 - Remote Command Execution

Luigi Auriemma Application: SAP MaxDB https://www.sdn.sap.com/irj/sdn/maxdb http://www.sap.com Versions: = 7.6.03 build 007 Platforms: Windows, Linux and Solaris Bug: pre-auth remote commands execution Exploitation: remote Date: 09 Jan 2008 Author: Luigi Auriemma e-mail: [email protected] web:...

SAP MaxDB未明远程执行漏洞

BUGTRAQ ID: 26822 CNCAN ID:CNCAN-2007121207 MaxDB是SAP授权给MySQL的基于SAP DB的数据库。 SAP MaxDB存在未明安全问题，本地攻击者可以利用漏洞以应用程序进程权限执行任意指令。 目前没有详细漏洞细节提供。 SAP MaxDB 7.6.00.37 SAP MaxDB 7.4.3.32 目前没有解决方案提供： https://www.sdn.sap.com/irj/sdn/maxdb...

SAP DB / MaxDB Web Server DBM_INTERN_TEST Event Buffer Overflow

The remote host is running SAP DB or MaxDB, a SAP-certified open- source database supporting OLTP and OLAP. According to its version, the Web DBM component of SAP DB or MaxDB on the remote host reportedly contains a stack-based buffer overflow triggered when displaying user-supplied arguments as...