CVE-2017-7221

Related Files

OpenText Documentum Content Server SQL Injection

Posted Apr 25, 2017

Authored by Andrey B. Panfilov

OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to execute arbitrary code with super-user privileges by leveraging the availability of the dm_bp_transition docbase method with a user-created dm_procedure object, as demonstrated by use of a backspace character in an injected string. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513. This code is a proof of concept exploit.

tags | exploit, remote, arbitrary, sql injection, proof of concept

advisories | CVE-2014-2513, CVE-2015-4533, CVE-2017-7221

SHA-256 | 075e41464f5a5b594ef398cfbdc839e338020d08e61a4d818296c681db42b4d7

Download | Favorite | View