Published: 12/01/2008 Updated: 15/10/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

SAP MaxDB 7.6.03 build 007 and previous versions allows remote malicious users to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sap maxdb

####################################################################### Luigi Auriemma Application: SAP MaxDB wwwsdnsapcom/irj/sdn/maxdb wwwsapcom Versions: <= 7603 build 007 Platforms: Windows, Linux and Solaris Bug: pre-auth remote commands execut ...

This is a functional proof of concept program to aid in exploiting systems vulnerable to CVE 2008-0244. This vulnerability specifically relates to issues in how the SAP MaxDB protocol handles specially crafted packets. It is possible to execute system level commands remotely.

sapmdbret This is a functional exploit proof of concept program to aid in exploiting systems vulnerable to CVE 2008-0244 This vulnerability specifically relates to issues in how the SAP MaxDB protocol handles specially crafted packets It is possible to execute system level commands remotely Please note that some values (such as attacker IP, and the commands being executed)

CWE-20 http://aluigi.altervista.org/adv/sapone-adv.txt http://www.securityfocus.com/bid/27206 http://www.securitytracker.com/id?1019171 http://secunia.com/advisories/28409 http://securityreason.com/securityalert/3536 http://www.vupen.com/english/advisories/2008/0104 https://exchange.xforce.ibmcloud.com/vulnerabilities/39573 https://www.exploit-db.com/exploits/4877 http://www.securityfocus.com/archive/1/486039/100/0/threaded https://nvd.nist.gov https://github.com/gregkcarson/sapmdbret https://www.exploit-db.com/exploits/4877/

CVE-2008-0244

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect