CVE-2016-7402

Critical

Published: 03/11/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

SAP ASE version 16.0 SP02 PL03 and prior allows attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system administrator) via dbcc import_sproc SQL injection.

Risk Assessment

Privilege escalation to system administrator level can lead to complete control over the database, posing a serious threat to the organization's data security.

Recommendation

It is recommended to upgrade to the latest version of SAP ASE and implement appropriate security measures to minimize the risk of SQL injection.

Original NVD description (English source)

SAP ASE 16.0 SP02 PL03 and prior versions allow attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system administrator) via dbcc import_sproc SQL injection.