CVE-2008-0244

Published: Jan 12, 2008Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe.

Affected (1)

Products: Sap: Maxdb

Sap

1 product

Maxdb

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sap Maxdb	Up to 7.6.3_build_007

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (18)

http://aluigi.altervista.org/adv/sapone-adv.txt

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/28409

Source: cve@mitre.org

Vendor Advisory

http://securityreason.com/securityalert/3536

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/486039/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/27206

Source: cve@mitre.org

Exploit

http://www.securitytracker.com/id?1019171

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0104

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/39573

Source: cve@mitre.org

https://www.exploit-db.com/exploits/4877

Source: cve@mitre.org

http://aluigi.altervista.org/adv/sapone-adv.txt