cbcvebase.
CVE-2002-0186
published 2002-07-03

CVE-2002-0186: Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long…

PriorityP349high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
55.45%
99.0th percentile
Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension."

Affected

1 ranges
VendorProductVersion rangeFixed in
microsoftsql_server——

Detection & IOCsextracted from sources · hover to see the quote

pathIIS-Server/Nwind/Template/catalog.xml?contenttype=text/AAAA...AAA↗
processinetinfo.exe↗
  • →Monitor HTTP requests to SQLXML ISAPI virtual directories for abnormally long `contenttype` (content-type) parameter values, which are the overflow trigger vector. ↗
  • →Alert on requests targeting XML template files (e.g., catalog.xml) in SQLXML virtual directories where the `contenttype` query-string parameter contains an unusually large payload (repeated characters / padding). ↗
  • →Unexpected crashes or restarts of inetinfo.exe on IIS hosts running SQL Server 2000 SQLXML ISAPI extensions may indicate active exploitation attempts. ↗
  • ·SQLXML HTTP virtual directories are NOT enabled by default; this attack surface only exists on SQL Server 2000 instances where SQLXML ISAPI has been explicitly configured and exposed via IIS. ↗
  • ·The SQLXML ISAPI extension runs with LocalSystem privileges, meaning successful exploitation grants the highest level of OS access. ↗
  • ·The vulnerability was confirmed on SQL Server 2000 Gold; other versions may also be affected and should be evaluated. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.