CVE-2017-11384 - SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input validation in mdHandlerLicenseManager.dll

Back Back to CVE browser

CRITICAL

SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input validation in mdHandlerLicenseManager.dll

Published Aug 2, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 38.48%

Description

SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input validation in mdHandlerLicenseManager.dll. Formerly ZDI-CAN-4561.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (5)

http://www.securityfocus.com/bid/100078
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1039049
vdb-entryx_refsource_SECTRACK
http://www.zerodayinitiative.com/advisories/ZDI-17-494
x_refsource_MISCThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3011
Advisory
https://success.trendmicro.com/solution/1117722
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/100078		vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1039049		vdb-entryx_refsource_SECTRACK
http://www.zerodayinitiative.com/advisories/ZDI-17-494		x_refsource_MISCThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-3011		Advisory
https://success.trendmicro.com/solution/1117722		x_refsource_MISCPatchVendor Advisory