CVE-2002-1576
SAP DB 7.3 - Local Privilege Escalation via lserversrv Path Manipulation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2002-1576. PoCs published by SAP Security.
AI-analyzed exploit summary This exploit leverages a symbolic link attack in SAP DB's lserver binary to execute a malicious 'lserversrv' binary with root privileges. The attacker creates a directory with a specific name, places a malicious binary, and tricks lserver into executing it due to insufficient path checks.
Description
lserver in SAP DB 7.3 and earlier uses the current working directory to find and execute the lserversrv program, which allows local users to gain privileges with a malicious lserversrv that is called from a directory that has a symlink to the lserver program.
Exploits (1)
This exploit leverages a symbolic link attack in SAP DB's lserver binary to execute a malicious 'lserversrv' binary with root privileges. The attacker creates a directory with a specific name, places a malicious binary, and tricks lserver into executing it due to insufficient path checks.