← Vulnerability feed

Vulnerability record · CVE-2003-0118 · published 12 May 2003

CVE-2003-0118: Microsoft biztalk server vulnerability

Microsoft · Biztalk Server

SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to (1) rawdocdata.asp or (2) RawCustomSearchField.asp containing an embedded SQL statement.

7.5 CVSS 2.0 High EPSS 8.1% · top 5.3%
7.5CVSS 2.0 base score
8.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
16 Jun 2026Last modified by NVD

Description

SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to (1) rawdocdata.asp or (2) RawCustomSearchField.asp containing an embedded SQL statement.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://marc.info/?l=bugtraq&m=105216839231951&w=2
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-016
http://marc.info/?l=bugtraq&m=105216839231951&w=2
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-016

Track CVE-2003-0118 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2012-0158Microsoft MSCOMCTL.OCX ActiveX controls remote code executionThe ListView, ListView2, TreeView and TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls fail to handle crafted input, allowing memory…KEVEPSS 100%analysed9.3CVE-2009-2496Microsoft biztalk server memory buffer overflow vulnerabilityHeap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Of…EPSS 29%9.3CVE-2007-1201Microsoft biztalk server code injection vulnerabilityUnspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary c…EPSS 29%9.3CVE-2007-0940Microsoft CAPICOM Certificates ActiveX control remote code executionAn unspecified vulnerability in the CAPICOM Certificates ActiveX control (CAPICOM.dll) shipped with Microsoft CAPICOM and BizTalk Server 2004 SP1/SP2…EPSS 76%analysed7.5CVE-2003-0117Microsoft biztalk server vulnerabilityBuffer overflow in the HTTP receiver function (BizTalkHTTPReceive.dll ISAPI) of Microsoft BizTalk Server 2002 allows attackers to execute arbitrary c…EPSS 9.1%4.3CVE-2015-2475Microsoft biztalk server cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in uddi/search/frames.aspx in the UDDI Services component in Microsoft Windows Server 2008 SP2 and BizTalk S…EPSS 15%

Source: NIST National Vulnerability Database (record CVE-2003-0118), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.