Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-3614

6 documents4 sources
Severity
7.5HIGH
EPSS
84.1%
top 0.69%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
SAP SAP DB
Timeline
PublishedJul 6
Latest updateMay 1

Description

Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers to execute arbitrary code via (1) a certain cookie value; (2) a certain additional parameter, related to sapdbwa_GetQueryString; and other unspecified vectors related to "numerous other fields."

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDsap/sap_db8 versions+7

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9jvm-5xgq-52vp: Multiple stack-based buffer overflows in waHTTP↗2022-05-01
▶
CVEList
CVE-2007-3614: Multiple stack-based buffer overflows in waHTTP↗2007-07-06
▶

💥Exploits & PoCs

3
Exploit-DB
SAP DB 7.4 - WebTools Buffer Overflow (Metasploit)↗2010-07-16
▶
Exploit-DB
SAP DB 7.4 - WebTools Remote Overwrite (SEH)↗2007-07-07
▶
Exploit-DB
SAP DB 7.x Web Server - 'WAHTTP.exe' Multiple Buffer Overflow Vulnerabilities↗2007-07-05
▶