0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
SAP MaxDB <= 7.6.03.07 pre-auth Remote Command Execution Exploit
[================================================================
SAP MaxDB <= 7.6.03.07 pre-auth Remote Command Execution Exploit
================================================================
#######################################################################
Luigi Auriemma
Application: SAP MaxDB
https://www.sdn.sap.com/irj/sdn/maxdb
http://www.sap.com
Versions: <= 7.6.03 build 007
Platforms: Windows, Linux and Solaris
Bug: pre-auth remote commands execution
Exploitation: remote
Date: 09 Jan 2008
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
SAP MaxDB is a commercial and widely known and used database.
#######################################################################
======
2) Bug
======
The MaxDB server executes "cons.exe DATABASE COMMAND" through system()
when some special commands are called by the user.
Some of these special commands are "show" and "exec_sdbinfo" and this
last one is just one of the small amount of commands which can be
executed by the unauthenticated users before logging in.
The usage of system() for executing the cons program allows an external
unauthenticated attacker to execute any command he wants on the target
SAP MaxDB server simply passing the "&&" or other patterns for the
execution of multiple commands in the shell.
So it's just enough to use the following SAP command to see the content
of C: on Windows (the bug is naturally exploitable on any other
platform supported by the server):
exec_sdbinfo && echo dir c:\ | cmd.exe
Then the rest and all the other possibilities of exploiting this
vulnerability are in the fantasy of the attacker...
#######################################################################
===========
3) The Code
===========
http://www.inj3ct0r.com/sploits/9103.zip
#######################################################################
======
4) Fix
======
No fix
# 0day.today [2024-11-15] #