CVE-2016-2386

SAP NetWeaver SQL Injection Vulnerability

Netweaver Application Server Java

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

16. Feb 2016

Ausgewertete Quellen

• Hinweis
  http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html
• Hinweis
  http://seclists.org/fulldisclosure/2016/May/56
• Hinweis
  https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/
• Hinweis
  https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
• Hinweis
  https://www.exploit-db.com/exploits/39840/
• Hinweis
  https://www.exploit-db.com/exploits/43495/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386
• CISA
  SAP NetWeaver SQL Injection Vulnerability
• NVD
  CVE-2016-2386
• GitHub
  https://github.com/vah13/SAP_exploit