CVE-2015-9098

CRITICAL

Redgate SQL Monitor < 3.10 and 4.x < 4.2 - Unauthenticated SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-9098. PoCs published by Paul Taylor.

AI-analyzed exploit summary This exploit demonstrates an authentication bypass in Red-Gate SQL Monitor, allowing unauthenticated access to execute arbitrary SQL commands and potentially achieve remote code execution via xp_cmdshell if the SQL Server runs with elevated privileges.

Description

In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges).

Exploits (1)

exploitdb WORKING POC
by Paul Taylor · textwebappswindows
https://www.exploit-db.com/exploits/42444

This exploit demonstrates an authentication bypass in Red-Gate SQL Monitor, allowing unauthenticated access to execute arbitrary SQL commands and potentially achieve remote code execution via xp_cmdshell if the SQL Server runs with elevated privileges.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Redgate SQL Monitor before 3.10 and 4.x before 4.2
No auth needed
Prerequisites: Access to the login page of the target Red-Gate SQL Monitor instance · A test environment to replicate the vulnerability
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42444/

Scores

CVSS v3 9.8
EPSS 0.3999
EPSS Percentile 97.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (3)
red-gate/sql_monitor 4.0
red-gate/sql_monitor 4.1
red-gate/sql_monitor < 3.5
Published Jun 22, 2017
Tracked Since Feb 18, 2026