critical9.8Known exploitedPublic exploit code
CVE-2016-2386
SAP NetWeaver SQL Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-06-09. Federal due date: 2022-06-30.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SAP NetWeaver J2EE Engine 7.40 - SQL Injection2018-01-10 · webapps · multiple
- SAP NetWeaver AS JAVA 7.1 < 7.5 - SQL Injection2016-05-19 · webapps · xml
Impact
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Netweaver Application Server Java | Version 7.40 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html
- http://seclists.org/fulldisclosure/2016/May/56
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
- https://github.com/vah13/SAP_exploit
- https://www.exploit-db.com/exploits/39840/
- https://www.exploit-db.com/exploits/43495/
- http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html
- http://seclists.org/fulldisclosure/2016/May/56
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
- https://github.com/vah13/SAP_exploit
- https://www.exploit-db.com/exploits/39840/
- https://www.exploit-db.com/exploits/43495/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386