CA Total Defense Suite DeleteReports Stored Procedure SQL Injection Leads to RCE (CVE-2011-1653)

``` - **Date**: April 13th, 2011 - **ID (ZDI)**: - ZDI-11-133 - ZDI-CAN-1043 - **CVE ID**: CVE-2011-1653 - **CVSS Score**: 10.0, AV:N/AC:L/Au:N/C:C/I:C/A:C - **Affected Vendors**: CA - **Affected Products**: Total Defense Suite - **Vulnerability Details**: - Remote attackers can execute arbitrary code on vulnerable CA Total Defense Suite installations. Exploitation of this vulnerability does not require authentication. - The specific vulnerability resides in the DeleteReports stored procedure, which is accessible via the management.asmx console. The management web service listens for SOAP 1.2 requests on port 34444. Due to a flaw in the implementation of the DeleteReports stored procedure, remote unauthenticated users can inject arbitrary SQL commands within the SOAP request, ultimately leading to arbitrary code execution in the context of the SYSTEM user via the exec function. - **Additional Details**: - CA has released a vulnerability fix update. More information is available at: https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={CD065CEC-AFE2-4D9D-8E0B-BE7F6E345866} - **Disclosure Timeline**: - 2011-01-21: Vulnerability reported to vendor - 2011-04-13: Coordinated advisory release - **Credit**: Andrea Micalizzi aka rgod ```

Goal Reached Thanks to every supporter — we hit 100%!

CA Total Defense Suite DeleteReports Stored Procedure SQL Injection Leads to RCE (CVE-2011-1653)