PT-2019-11586 · Microsoft+1 · Mssql+1

P0W1 · Publicado 2019-05-31 · Atualizado 2019-06-03 · CVE-2019-10123

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Advanced InfoData Systems (AIS) ESEL-Server version 67

Description: The issue allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database. The default user for the database is the sa user.

Recommendations: For Advanced InfoData Systems (AIS) ESEL-Server version 67, consider restricting access to the MSSQL database to minimize the risk of exploitation. As a temporary workaround, limit the privileges of the sa user until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-10123

Produtos afetados

Esel-Server

Mssql

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/ais_esel_server_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/pull/11641 · Exploit
• 🔥 https://exploit-db.com/exploits/46782 · Exploit
• https://osv.dev/vulnerability/CVE-2019-10123 · Aviso do Fabricante
• https://ais.de · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10123 · Nota de Segurança