PT-2013-5930 · Sap · Sap Sybase Adaptive Server Enterprise

Igor Bulatenko · Published 2013-10-19 · Updated 2017-09-13 · CVE-2013-6025

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Sybase Adaptive Server Enterprise (ASE) version 15.7 ESD 2

Description The issue allows remote authenticated users to read arbitrary files via a SQL statement containing an XML document with an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Recommendations For SAP Sybase Adaptive Server Enterprise (ASE) version 15.7 ESD 2, consider restricting access to the XMLParse procedure to minimize the risk of exploitation. As a temporary workaround, consider disabling the XMLParse procedure until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-6025

Affected Products

Sap Sybase Adaptive Server Enterprise

References · 7

• 🔥 https://exploit-db.com/exploits/38805 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6025 · Security Note
• http://securityfocus.com/bid/63193 · Note
• http://secunia.com/advisories/55377 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/88105 · Note
• http://kb.cert.org/vuls/id/303900 · Note
• http://securitytracker.com/id/1029208 · Note