SAS Studio vulnerabilities

A Directory Traversal vulnerability in SAS Studio 9.4 allows a remote attacker to access internal files by manipulating the default path during file download. The attack requires knowledge of the session ID and internal path.

Unrestricted file upload in SAS Studio 9.4 via the path /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} may allow a remote attacker to upload malicious files. The vendor disputes this, stating that file upload is only allowed for authorized users.

SQL injection vulnerability in SAS Studio 9.4 at /SASStudio/sasexec/sessions/{sessionID}/sql allows a remote attacker to execute arbitrary SQL commands via the POST body request. The vendor disputes this, stating that SQL statement execution is allowed for authorized users.