CVE-2018-3602: Trend Micro Control Manager AdHocQuery_Processor ProductLogQuery SQL Injection Remote Code Execution Vulnerability
An AdHocQueryProcessor SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the GetProductCategory method, which is called by the AdHocQueryProcessor servlet. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code under the context of the Network Service account.
— ZDI
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3602?
The severity of CVE-2018-3602 is high with a severity value of 8.8.
How can remote attackers exploit CVE-2018-3602?
Remote attackers can exploit CVE-2018-3602 by executing arbitrary code on vulnerable installations of Trend Micro Control Manager.
Is authentication required to exploit CVE-2018-3602?
Yes, authentication is required to exploit CVE-2018-3602. However, the existing authentication mechanism can be bypassed.
What software is affected by CVE-2018-3602?
Trend Micro Control Manager version 6.0 is affected by CVE-2018-3602.
How can I fix CVE-2018-3602?
To fix CVE-2018-3602, update Trend Micro Control Manager to a patched version provided by the vendor.