CVE-2008-0244
SAP MaxDB < 7.6.3_build_007 - Remote Command Execution via Shell Metacharacters in exec_sdbinfo
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-0244.
PoCs published by Luigi Auriemma, MC, including Metasploit module auxiliary/admin/maxdb/maxdb_cons_exec.
AI-analyzed exploit summary The writeup describes a pre-authentication remote command execution vulnerability in SAP MaxDB <= 7.6.03 build 007. The issue arises from the use of system() to execute commands, allowing command injection via shell metacharacters like &&.
Description
SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe.
Exploits (2)
The writeup describes a pre-authentication remote command execution vulnerability in SAP MaxDB <= 7.6.03 build 007. The issue arises from the use of system() to execute commands, allowing command injection via shell metacharacters like &&.
This Metasploit module exploits a remote command injection vulnerability in SAP MaxDB's cons.exe by sending maliciously crafted packets to execute arbitrary commands. The exploit leverages improper input sanitization to achieve RCE.