30
35
42
55
30
55
35
60
55
60
30
60
60
30
30
30
42
30
55
42
60
60
60
60
30
30
60
55
47
60
42
60
60
60
30
42
[0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)
0day Rubbish disclosed an unauthenticated SOAP API flaw in DBxtra .NET 13.1.1.0 enabling xp_cmdshell command execution, rated CVSS 9.8.
The 0day Rubbish Research Team disclosed an unauthenticated remote code execution vulnerability in DBxtra .NET 13.1.1.0, classified as CWE-306 (missing authentication). The flaw is reachable via the unauthenticated SOAP API and abuses SQL Server's xp_cmdshell to run operating system commands. It is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No CVE identifier or exploitation evidence was provided in the disclosure.
40
47
30
42