CVE Catalog
CVE-2017-9246
CriticalSummary
New Relic .NET Agent before version 6.3.123.0 introduces SQL injection flaws to safe applications through mishandling of quotes when using the Slow Queries feature.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to database data, posing a serious security threat to the application.
Recommendation
It is recommended to update the New Relic .NET Agent to version 6.3.123.0 or later to mitigate these vulnerabilities.
Original NVD description (English source)
New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLAN_ALL ON protection mechanism.