Exploitation Summary
EIP tracks 3 public exploits for CVE-2000-1209.
PoCs published by Metasploit, David Kennedy, including Metasploit module exploits/windows/mssql/mssql_payload.
AI-analyzed exploit summary This Metasploit module exploits SQL injection vulnerabilities in Microsoft SQL Server to execute arbitrary payloads via xp_cmdshell. It supports multiple delivery methods including debug.exe, command stager, and PowerShell.
Description
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.
Exploits (3)
This Metasploit module exploits SQL injection vulnerabilities in Microsoft SQL Server to execute arbitrary payloads via xp_cmdshell. It supports multiple delivery methods including debug.exe, command stager, and PowerShell.
This Metasploit module exploits Microsoft SQL Server by leveraging the 'xp_cmdshell' stored procedure to execute arbitrary payloads. It supports multiple delivery methods, including debug.com, command stager, and PowerShell, to achieve remote code execution.
This Metasploit module exploits Microsoft SQL Server by leveraging the 'xp_cmdshell' stored procedure to execute arbitrary payloads. It supports multiple delivery methods, including PowerShell and command stager techniques, to achieve remote code execution.