Search: “xp_cmdshell”

[0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)

0day Rubbish disclosed an unauthenticated SOAP API flaw in DBxtra .NET 13.1.1.0 enabling xp_cmdshell command execution, rated CVSS 9.8.

The 0day Rubbish Research Team disclosed an unauthenticated remote code execution vulnerability in DBxtra .NET 13.1.1.0, classified as CWE-306 (missing authentication). The flaw is reachable via the unauthenticated SOAP API and abuses SQL Server's xp_cmdshell to run operating system commands. It is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No CVE identifier or exploitation evidence was provided in the disclosure.

Full Disclosure·Sep 8, 17:31 UTC · 7d agoVulnerability 2 sources

Ivanti Endpoint Manager Flaw Actively Targeted, CISA Warns Agencies to Patch

The Hacker News·Oct 7, 06:11 UTC · Oct 7, 2024Vulnerability in the wildCVE-2024-29824CVE-2024-8190CVE-2024-8963+1 CVEs

Fortinet Warns of Severe SQLi Vulnerability in FortiClientEMS Software

The Hacker News·Mar 22, 03:02 UTC · Mar 22, 2024Vulnerability in the wildCVE-2023-48788CVE-2023-42789CVE-2023-427901

Microsoft Warns of Cyber Attacks Attempting to Breach Cloud via SQL Server Instance

The Hacker News·Oct 9, 02:55 UTC · Oct 9, 2023Vulnerability

It’s ethical hacking with SQL injection on Pluralsight!

Troy Hunt·May 20, 23:00 UTC · May 20, 2015Vulnerability