$ cve CVE-2007-3614 JSON

CVE-2007-3614 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 70% (pctl 99)

Patch early

A public exploit exists.

Description

Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers to execute arbitrary code via (1) a certain cookie value; (2) a certain additional parameter, related to sapdbwa_GetQueryString; and other unspecified vectors related to "numerous other fields."

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	70% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2007-07-06
Last modified	2026-06-16

Affected (1)

Vendor	Product
sap	sap db

Public exploits

Source	Title	Date
exploit-db	SAP DB 7.4 - WebTools Buffer Overflow (Metasploit)	2010-07-16
exploit-db	SAP DB 7.4 - WebTools Remote Overwrite (SEH)	2007-07-07
exploit-db	SAP DB 7.x Web Server - 'WAHTTP.exe' Multiple Buffer Overflow Vulnerabilities	2007-07-05

References

→ the Explorer · watch your stack · NVD