medium4.0Public exploit code
CVE-2013-6025
The XMLParse procedure in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 ESD 2 allows remote authenticated users to read arbitrary files via a SQL statement …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SAP Sybase Adaptive Server Enterprise - XML External Entity Information Disclosure2015-11-25 · remote · multiple · Verified
Impact
The XMLParse procedure in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 ESD 2 allows remote authenticated users to read arbitrary files via a SQL statement containing an XML document with an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sybase | Adaptive Server Enterprise | Version 15.7 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/55377
- http://www.kb.cert.org/vuls/id/303900
- http://www.securityfocus.com/bid/63193
- http://www.securitytracker.com/id/1029208
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88105
- https://www.exploit-db.com/exploits/38805/
- http://secunia.com/advisories/55377
- http://www.kb.cert.org/vuls/id/303900
- http://www.securityfocus.com/bid/63193
- http://www.securitytracker.com/id/1029208
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88105
- https://www.exploit-db.com/exploits/38805/