VULNERABILITY INTELLIGENCE

CVE-2003-0938

CVSS score7.2 HIGH
EPSS probability0.44%
CISA KEVNot currently listed
Published2003-12-15
Last modified2026-06-16
CVSS vectorAV:L/AC:L/Au:N/C:C/I:C/A:C

Description

vos24u.c in SAP database server (SAP DB) 7.4.03.27 and earlier allows local users to gain SYSTEM privileges via a malicious "NETAPI32.DLL" in the current working directory, which is found and loaded by SAP DB before the real DLL, as demonstrated using the SQLAT stored procedure.

Primary references