Home / Vulnerability Database / T-SQL : Insecure function
T-SQL
T-SQL : Insecure function
Overview
The application uses an insecure xp_cmdshell function. This function launches a Windows command shell and executes the command that is provided in the argument string. The developer can not limit the scope of possible commands for a particular user. Any command will be executed with the existing user’s privileges.
References
- CWE-242: Use of Inherently Dangerous Function
- CWE-676: Use of Potentially Dangerous Function
- xp_cmdshell (Transact-SQL) - msdn.microsoft.com
- SQL Server Security Blog: xp_cmdshell
- SQL Server Security Blog: Using CLR to replace xp_cmdshell for specific tasks - blogs.msdn.microsoft.com
- Why We Recommend Against xp_cmdshell - sqlservercentral.com
- xp_cmdshell: should it ever be used? - security.stackexchange.com
CRITICAL
DerScanner Severity Score
Do you want to fix T-SQL : Insecure function in your application?
See also
T-SQL
T-SQL : Weak encryption algorithm
T-SQL
T-SQL : Weak hashing algorithm
T-SQL