Trend Micro Mobile Security for Enterprise SQL Injection Leading to RCE (CVE-2017-14078)

## Critical Vulnerability Information - **Vulnerability Title:** - Trend Micro Mobile Security for Enterprise get_moveto_group_list Device_DeviceId SQL Injection Remote Code Execution Vulnerability - **Vulnerability IDs:** - ZDI-17-810 - ZDI-CAN-4683 - CVE-2017-14078 - **CVSS Score:** - 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C) - **Affected Vendor:** - Trend Micro - **Affected Product:** - Mobile Security for Enterprise - **Mitigation:** - Trend Micro provides TippingPoint IPS protection via Digital Vaccine filter ID ['28286']. - **Vulnerability Details:** - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Mobile Security for Enterprise. Authentication is required to exploit this vulnerability. - The vulnerability exists in the processing of the get_moveto_group_list action, where the 'id' field is parsed without proper validation of user-supplied strings, leading to SQL injection during SQL query construction. This enables attackers to execute arbitrary code in the context of SYSTEM. - **Additional Information:** - Trend Micro has released an update patch. For details, see https://success.trendmicro.com/solution/1118224 - **Disclosure Timeline:** - 2017-05-11 - Vulnerability reported to vendor - 2017-09-15 - Coordinated public advisory released - **Discoverers:** - Steven Seeley (mr_me) from Offensive Security & Roberto Suggi Liverani (@malerisch - http://blog.malerisch.net/)

Goal Reached Thanks to every supporter — we hit 100%!

Trend Micro Mobile Security for Enterprise SQL Injection Leading to RCE (CVE-2017-14078)