« Volver al listado

CVE-2003-0118

Estado: ModificadaAlta (7.5)—

SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to (1) rawdocdata.asp or (2) RawCustomSearchField.asp containing an embedded SQL statement.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — Biztalk Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2003-0118",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2003-05-12T04:00:00.000",
  "references": [
    {
      "url": "http://marc.info/?l=bugtraq&m=105216839231951&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-016",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=105216839231951&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-016",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to (1) rawdocdata.asp or (2) RawCustomSearchField.asp containing an embedded SQL statement."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección de SQL en el sitio web de Administración y Seguimiento de Documentos (DTA) de Microsoft BizTalk Server 2000 y 2002 permite a atacantes remotos  ejecutar comandos del sistema operativo mediante una URL conteniendo una sentencia SQL embebida."
    }
  ],
  "lastModified": "2026-06-16T22:01:34.660",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2000:*:developer:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4B1FCA6-8212-45F4-9F6A-BB1E985F13BA"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2000:*:enterprise:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0066D327-AA3D-453D-8DC4-FCCEA4DD72C1"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2000:*:standard:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD62B7D1-9196-412A-96F7-C649F78E541E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2000:sp1a:developer:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B06F62E-8D53-4117-BC02-76434F64B0D3"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2000:sp1a:enterprise:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB07ACDA-9DE2-425D-B8CC-71FC5C063C1E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2000:sp1a:standard:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE7C6E2A-362A-47A5-8C32-7D28BF732943"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2000:sp2:developer:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F008518-056A-4715-ACEB-D32A2F5550E7"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2000:sp2:enterprise:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBFACFE1-A633-4AFC-9F00-C4CE161D25B8"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2000:sp2:standard:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8F2D5C0-B8D7-41F3-8E31-83F9B4341CFC"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2002:*:developer:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64C5E7CD-9528-4CE5-9651-0924B30DDF67"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:biztalk_server:2002:*:enterprise:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAD1261A-7BFF-487F-9FF9-F75D54AA8568"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}