{"uuid": "e0e8c5f8-1e92-42bb-9544-3d2c87e907b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-2286", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/altiris_ds_sqli.rb", "content": "{\"aliases\": [], \"arch\": \"x86\", \"author\": [\"Brett Moore\", \"3v0lver\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a SQL injection flaw in Symantec Altiris Deployment Solution 6.8\\n          to 6.9.164. The vulnerability exists on axengine.exe which fails to adequately sanitize\\n          numeric input fields in \\\"UpdateComputer\\\" notification Requests. In order to spawn a shell,\\n          several SQL injections are required in close succession, first to enable xp_cmdshell, then\\n          retrieve the payload via TFTP and finally execute it. The module also has the capability\\n          to disable or enable local application authentication. In order to work the target system\\n          must have a tftp client available.\", \"disclosure_date\": \"2008-05-15\", \"fullname\": \"exploit/windows/misc/altiris_ds_sqli\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"Symantec Altiris DS SQL Injection\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/misc/altiris_ds_sqli.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/misc/altiris_ds_sqli\", \"references\": [\"CVE-2008-2286\", \"OSVDB-45313\", \"BID-29198\", \"URL-http://www.zerodayinitiative.com/advisories/ZDI-08-024\"], \"rport\": 402, \"session_types\": false, \"targets\": [\"Windows 2003 (with tftp client available)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:14.888250Z"}