CVE-2017-17414: SQL Injection
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4225.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17414?
CVE-2017-17414 is considered a critical vulnerability due to its ability to allow remote attackers to execute arbitrary code.
How do I fix CVE-2017-17414?
The recommended fix for CVE-2017-17414 is to update Quest NetVault Backup to a version that is not affected by this vulnerability.
What versions of Quest NetVault Backup are affected by CVE-2017-17414?
Quest NetVault Backup version 11.3.0.12 is specifically affected by CVE-2017-17414.
Can CVE-2017-17414 be exploited without authentication?
Yes, CVE-2017-17414 can be exploited without authentication, making it particularly dangerous.
What type of attack is facilitated by CVE-2017-17414?
CVE-2017-17414 facilitates remote code execution attacks on vulnerable installations of Quest NetVault Backup.