#microsoft

Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability

March’s Patch Tuesday is relatively light, containing 60 vulnerabilities — only two labeled “critical.”

**According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is information disclosure?** The attack itself is carried out locally. For example, when the score indicates that the **Attack Vector** is **Local** (AV:L) and **User Interaction** is **Required** (UI:R), this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and run a malicious application. This could lead to a local attack on the user's device which could leak data.

**According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?** An authenticated victim who is connected to the network must be tricked or persuaded to connect to a malicious SQL database using their SQL client application. After the connection is made, the server can send specially crafted replies to the client that exploit the vulnerability and permit execution of arbitrary code within the context of the user's SQL client application.

**According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?** An authenticated victim who is connected to the network must be tricked or persuaded to connect to a malicious SQL database using their SQL client application. After the connection is made, the server can send specially crafted replies to the client that exploit the vulnerability and permit execution of arbitrary code within the context of the user's SQL client application.

**How could an attacker exploit this vulnerability?** An attacker could exploit the vulnerability by tricking an authenticated user into attempting to connect to a malicious SQL server via OLEDB, which could result in the server receiving a malicious networking packet. This could allow the attacker to execute code remotely on the client.

**What privileges could be gained by an attacker who successfully exploited this vulnerability?** An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

**According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?** Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.

**According to the CVSS metric, Attack Vector is Local (AV:L). What does that mean for this vulnerability?** An attacker would have to have local presence on the device through malware or a malicious application to be able to exploit this vulnerability.

**How could an attacker exploit the vulnerability?** An attacker could use the unsanitized parameter into a SQL query to trigger SQL Injection.