CVE-2018-3603: Trend Micro Control Manager CCGIServlet ID_QUERY_COMMAND_TRACKING_USER_ID SQL Injection Remote Code Execution Vulnerability
A CGGIServlet SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within processing of the IDQUERYCOMMANDTRACKINGUSERID parameter of the CCGIServlet servlet . The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code under the context of the Network Service account.
— ZDI
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-3603?
CVE-2018-3603 is a vulnerability that allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager.
What is the severity of CVE-2018-3603?
CVE-2018-3603 has a severity rating of 8.8, which is considered high.
How does CVE-2018-3603 affect Trend Micro Control Manager?
CVE-2018-3603 affects Trend Micro Control Manager by allowing remote attackers to execute arbitrary code on vulnerable installations.
What is the recommended solution for CVE-2018-3603?
To mitigate CVE-2018-3603, it is recommended to apply the necessary security patches or updates provided by Trend Micro.
Where can I find more information about CVE-2018-3603?
More information about CVE-2018-3603 can be found at the following references: [CVE-2018-3603](https://success.trendmicro.com/solution/1119158) and [ZDI-18-112](https://www.zerodayinitiative.com/advisories/ZDI-18-112/).