CVE-2018-10350: Trend Micro Smart Protection Server BWListMgmt SQL Injection Remote Code Execution Vulnerability
A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw within the handling of parameters provided to wcs\bwlists\handler.php. Authentication is required in order to exploit this vulnerability.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Smart Protection Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of parameters provided to wcs\bwlists\handler.php. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to remotely execute code under the context of webserv.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10350?
CVE-2018-10350 has a high severity rating as it allows remote code execution due to SQL injection.
How do I fix CVE-2018-10350?
To fix CVE-2018-10350, update to the latest version of Trend Micro Smart Protection Server that addresses this vulnerability.
What versions of Trend Micro Smart Protection Server are affected by CVE-2018-10350?
CVE-2018-10350 affects Trend Micro Smart Protection Server versions 3.0, 3.1, 3.2, and 3.3.
What type of vulnerability is CVE-2018-10350?
CVE-2018-10350 is classified as a SQL injection vulnerability that leads to remote code execution.
Can CVE-2018-10350 be exploited without authentication?
Yes, CVE-2018-10350 can potentially be exploited by an unauthenticated remote attacker.