Vulnerability record · CVE-2016-4350 · published 9 May 2016
CVE-2016-4350: SolarWinds Storage Resource Monitor web server SQL injection
Solarwinds · Storage Resource Monitor
The Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler before 6.2.3 fails to sanitize dozens of servlet parameters, leaving 34 distinct SQL injection points across servlets such as ScriptServlet, WindowsEventLogsServlet, ProcessesServlet and BackupExceptionsServlet. Because the flaws are unauthenticated and remotely reachable, they expose the backend database to arbitrary command execution. The record does not list affected builds beyond the fixed 6.2.3 version.
Description
Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storage Manager (STM)) before 6.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) ScriptSchedule parameter in the ScriptServlet servlet; the (2) winEventId or (3) winEventLog parameter in the WindowsEventLogsServlet servlet; the (4) processOS parameter in the ProcessesServlet servlet; the (5) group, (6) groupName, or (7) clientName parameter in the BackupExceptionsServlet servlet; the (8) valDB or (9) valFS parameter in the BackupAssociationServlet servlet; the (10) orderBy or (11) orderDir parameter in the HostStorageServlet servlet; the (12) fileName, (13) sortField, or (14) sortDirection parameter in the DuplicateFilesServlet servlet; the (15) orderFld or (16) orderDir parameter in the QuantumMonitorServlet servlet; the (17) exitCode parameter in the NbuErrorMessageServlet servlet; the (18) udfName, (19) displayName, (20) udfDescription, (21) udfDataValue, (22) udfSectionName, or (23) udfId parameter in the UserDefinedFieldConfigServlet servlet; the (24) sortField or (25) sortDirection parameter in the XiotechMonitorServlet servlet; the (26) sortField or (27) sortDirection parameter in the BexDriveUsageSummaryServlet servlet; the (28) state parameter in the ScriptServlet servlet; the (29) assignedNames parameter in the FileActionAssignmentServlet servlet; the (30) winEventSource parameter in the WindowsEventLogsServlet servlet; or the (31) name, (32) ipOne, (33) ipTwo, or (34) ipThree parameter in the XiotechMonitorServlet servlet.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with a very high EPSS score, makes this a top-priority patch despite the absence of KEV listing.
What it is
The Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler before 6.2.3 fails to sanitize dozens of servlet parameters, leaving 34 distinct SQL injection points across servlets such as ScriptServlet, WindowsEventLogsServlet, ProcessesServlet and BackupExceptionsServlet. Because the flaws are unauthenticated and remotely reachable, they expose the backend database to arbitrary command execution. The record does not list affected builds beyond the fixed 6.2.3 version.
Impact
An attacker can execute arbitrary SQL against the SRM database, enabling data theft, modification or deletion of monitoring and storage records, and potentially further compromise of the host depending on database privileges.
Attack surface
Reachable over the network through the SRM Web Services HTTP interface; the CVSS vector shows no privileges or user interaction required, so any host that can reach the web server can send crafted requests to the listed servlet parameters.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high at 0.70 (99.3rd percentile) and the references include 24 Zero Day Initiative advisories, indicating coordinated disclosure of working vulnerability reports.
What to do
- Upgrade SolarWinds Storage Resource Monitor Profiler to version 6.2.3 or later, which the vendor advisory states fixes these issues.
- If immediate upgrade is not possible, restrict network access to the SRM Web Services interface to trusted management networks only.
- Place the SRM web server behind a WAF or reverse proxy with SQL injection filtering for the affected servlet paths.
- Review database account privileges used by SRM and reduce them to the minimum needed to limit the impact of successful injection.
- Monitor vendor and ZDI advisories for any follow-up patches or updated guidance.
Detection
- Inspect web server and proxy logs for requests to the affected servlets (ScriptServlet, WindowsEventLogsServlet, ProcessesServlet, BackupExceptionsServlet and others) containing SQL metacharacters such as quotes, UNION, OR 1=1 or comment sequences.
- Alert on unusual SQL error responses or 500 status codes returned from SRM web endpoints.
- Baseline normal parameter values for the listed servlets and flag deviations in orderBy, sortField, fileName, udfName and similar fields.
- Monitor database logs for anomalous queries or errors originating from the SRM application account.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-4350 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-4350), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
