Sploitus

Exploit for MySQL MaxDB cons.exe command injection

CVE-2008-0244

saint · 2008-01-16

Exploit Code

MARKDOWN27 lines
## https://sploitus.com/exploit?id=SAINT:45D51A95ABF6940D6034917C7475B5E4
Added: 01/16/2008  
CVE: [CVE-2008-0244](<https://vulners.com/cve/CVE-2008-0244>)  
BID: [27206](<http://www.securityfocus.com/bid/27206>)  
OSVDB: [40210](<http://www.osvdb.org/40210>)  


### Background

[MaxDB](<http://www.mysql.com/products/maxdb/>) is a SAP-certified open-source database developed by [MySQL](<http://www.mysql.com>). 

### Problem

The MaxDB server handles the `**exec_sdbinfo**` command by invoking the `**cons.exe**` program through a `**system**` call without sufficiently checking the arguments for invalid characters. This allows a remote, unauthenticated attacker to inject arbitrary commands by putting special sequences such as `**&&**` in the arguments. 

### Resolution

[Upgrade](<http://dev.mysql.com/downloads/maxdb/7.6.00.html>) to a version of MaxDB higher than 7.6.00.37 when available. 

### References

<http://milw0rm.com/exploits/4877>  


### Limitations

Exploit works on MaxDB 7.6.0.37.