CVE-2013-7369 SQL injection in n/a

What is CVE-2013-7369?

CVE-2013-7369 is a high-severity SQL injection vulnerability in n/a, published on 18 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SQL injection vulnerability in an unspecified DLL in the FSDBCom ActiveX control in F-Secure Anti-Virus for Microsoft Exchange Server before HF02, Anti-Virus for Windows Servers 9.00 before HF09, Anti-Virus for Citrix Servers 9.00 before HF09, and F-Secure Email and Server Security and F-Secure Server Security 9.20 before HF01 allows remote attackers to execute arbitrary SQL commands via unknown vectors, related to GetCommand.

Weakness: CWE-89

Which versions are affected by CVE-2013-7369?

It affects 3 products.

Products include F-Secure Anti-Virus, F-Secure Email and Server Security, F-Secure Server Security.

How do I fix CVE-2013-7369?

No fix has been published for CVE-2013-7369 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2013-7369 being exploited?

There is no known exploitation of CVE-2013-7369 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2009-1782 Security feature bypass in n/a Medium 6.8
• CVE-2010-3499 Security feature bypass in n/a Medium 6.4
• CVE-2010-1425 Security feature bypass in n/a Medium 5.0
• CVE-2012-6646 Security feature bypass in n/a Low 2.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cp35-64v5-r4w6.