CVE-2017-17415: SQL Injection
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Count method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4226.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17415?
CVE-2017-17415 is considered a critical vulnerability due to its ability to allow remote attackers to execute arbitrary code without authentication.
How do I fix CVE-2017-17415?
To mitigate CVE-2017-17415, it is recommended to upgrade Quest NetVault Backup to a patched version that addresses this vulnerability.
What software is affected by CVE-2017-17415?
CVE-2017-17415 specifically affects Quest NetVault Backup version 11.3.0.12.
Can CVE-2017-17415 be exploited remotely?
Yes, CVE-2017-17415 can be exploited remotely, allowing attackers to target vulnerable systems over the internet.
Is authentication required to exploit CVE-2017-17415?
No, authentication is not required to exploit CVE-2017-17415, making it particularly dangerous for unprotected installations.