CVE-2017-17423: SQL Injection
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackupSegment Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4234.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17423?
CVE-2017-17423 is classified as a critical vulnerability due to its potential for remote code execution without authentication.
How do I fix CVE-2017-17423?
To fix CVE-2017-17423, update Quest NetVault Backup to a version that is not affected by this vulnerability.
What type of attack can exploit CVE-2017-17423?
CVE-2017-17423 can be exploited by remote attackers to execute arbitrary code on vulnerable systems.
Is authentication required to exploit CVE-2017-17423?
No, authentication is not required to exploit CVE-2017-17423, making it particularly dangerous.
Which versions of Quest NetVault Backup are affected by CVE-2017-17423?
CVE-2017-17423 specifically affects Quest NetVault Backup version 11.3.0.12.