high7.5Public exploit code
CVE-2003-0118
SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to exec…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft BizTalk Server 2000/2002 DTA - 'RawCustomSearchField.asp' SQL Injection2003-04-30 · webapps · asp · Verified
- Microsoft BizTalk Server 2000/2002 DTA - 'rawdocdata.asp' SQL Injection2003-04-30 · webapps · asp · Verified
Impact
SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to (1) rawdocdata.asp or (2) RawCustomSearchField.asp containing an embedded SQL statement.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Biztalk Server | Versions 2000, 2002 |