SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows remote attackers…

Exploit prediction (EPSS)

32.68% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

• Metasploit exploit/windows/misc/altiris_ds_sqli Symantec Altiris DS SQL Injection · metasploit exploit, normal rank · 2008-05-15
• EDB-29552 Symantec Altiris DS - SQL Injection (Metasploit) · remote · 2013-11-13

CVSS scores

Classification

Weakness

• CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

• securityfocus.com /bid/29198 · vdb-entry, x_refsource_BID, x_transferred
• exchange.xforce.ibmcloud.com /vulnerabilities/42436 · vdb-entry, x_refsource_XF, x_transferred
• vupen.com /english/advisories/2008/1542/references · vdb-entry, x_refsource_VUPEN, x_transferred
• marc.info /?l=bugtraq&m=122167472229965&w=2 · vendor-advisory, x_refsource_HP, x_transferred
• zerodayinitiative.com /advisories/ZDI-08-024/ · x_refsource_MISC, x_transferred
• securityfocus.com /archive/1/492127/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
• symantec.com /avcenter/security/Content/2008.05.14a.html · x_refsource_CONFIRM, x_transferred
• exploit-db.com /exploits/29552 · exploit, x_refsource_EXPLOIT-DB, x_transferred
• securityfocus.com /archive/1/492229/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
• osvdb.org /show/osvdb/45313 · vdb-entry, x_refsource_OSVDB, x_transferred
• securitytracker.com /id?1020024 · vdb-entry, x_refsource_SECTRACK, x_transferred
• secunia.com /advisories/30261 · third-party-advisory, x_refsource_SECUNIA, x_transferred

Sources

• CVE List: CVE-2008-2286
• NVD: CVE-2008-2286

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.