CVE-2008-0244: SAP MaxDB command injection via shell metacharacters in exec_sdbinfo

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a CVSS 2.0 score of 10 and public exploit code makes this a top-priority exposure wherever MaxDB is internet- or network-reachable.

What it is

SAP MaxDB 7.6.03 build 007 and earlier fails to validate input passed to exec_sdbinfo and other commands, allowing shell metacharacters such as "&&" to be injected. Because MaxDB invokes cons.exe with this input, an unauthenticated remote attacker can run arbitrary commands on the host. The flaw is a classic improper input validation issue in a database service.

Impact

An attacker gains remote command execution with the privileges of the MaxDB service, which typically means full control of the database host, including reading or altering data and pivoting into the network.

Attack surface

Reachable over the network (AV:N, AC:L, Au:N) with no authentication or user interaction required, per the CVSS 2.0 vector and the description of remote attackers supplying metacharacters to MaxDB commands.

Exploitation

Public exploit code is referenced (Exploit-DB 4877 and the advisory), and EPSS is very high at 0.803 (99.6th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade MaxDB past 7.6.03 build 007 or apply the vendor fix referenced in the Secunia advisory.
• Restrict network access to MaxDB listener ports to trusted hosts only.
• Run the MaxDB service under a low-privilege account so command execution is contained.
• Monitor and block shell metacharacters in MaxDB command input where feasible.

Detection

• Alert on MaxDB or cons.exe spawning unexpected child processes such as cmd.exe or sh.
• Inspect MaxDB logs and network traffic for shell metacharacters (&&, |, ;) in exec_sdbinfo and similar command arguments.
• Baseline normal cons.exe process behavior and flag deviations in parent/child process trees.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.