CVE-2017-11388
HighSummary
Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue arises from improper validation of user-provided strings before constructing SQL queries in RestfulServiceUtility.NET.dll.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code on the server, potentially leading to severe security breaches and data loss.
Recommendation
It is recommended to update Trend Micro Control Manager to the latest version to mitigate this vulnerability and implement additional security measures against SQL Injection attacks.
Other vulnerabilities in Trend Micro Control Manager 6.0
See all- CVE-2017-11390High
CVE-2017-11390 is a vulnerability in XML external entity (XXE) processing in Trend Micro Control Manager 6.0, which could lead to information disclosure if exploited.
- CVE-2017-11387High
CVE-2017-11387 vulnerability in Trend Micro Control Manager 6.0 allows authentication bypass, leading to information disclosure. The issue occurs when authentication validation is not performed for functionality that changes the debug logging level.
- CVE-2017-11389Critical
Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory.
- CVE-2017-11386Critical
Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in cmdHandlerNewReportScheduler.dll.
- CVE-2017-11385Critical
Trend Micro Control Manager 6.0 has a SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in cmdHandlerStatusMonitor.dll.
- CVE-2017-11384Critical
Trend Micro Control Manager 6.0 has a SQL Injection vulnerability that can lead to Remote Code Execution. The issue is due to a lack of proper user input validation in mdHandlerLicenseManager.dll.
- CVE-2017-11383Critical
Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue arises from a lack of proper user input validation in cmdHandlerTVCSCommander.dll.
Original NVD description (English source)
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries. Formerly ZDI-CAN-4639 and ZDI-CAN-4638.