CVE-2013-7369

F-Secure Anti-Virus - SQL Injection via FSDBCom ActiveX Control

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in an unspecified DLL in the FSDBCom ActiveX control in F-Secure Anti-Virus for Microsoft Exchange Server before HF02, Anti-Virus for Windows Servers 9.00 before HF09, Anti-Virus for Citrix Servers 9.00 before HF09, and F-Secure Email and Server Security and F-Secure Server Security 9.20 before HF01 allows remote attackers to execute arbitrary SQL commands via unknown vectors, related to GetCommand.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-13-095/
Vendor Advisory x_refsource_confirm
http://www.f-secure.com/en/web/labs_global/fsc-2013-1

Scores

EPSS 0.0127
EPSS Percentile 66.9%

Details

CWE
CWE-89
Status published
Products (4)
f-secure/anti-virus 9.00 (3 CPE variants)
f-secure/anti-virus 9.10
f-secure/email_and_server_security 9.20
f-secure/server_security 9.20
Published Apr 18, 2014
Tracked Since Feb 18, 2026