[0day-rubbish] Exasol Database 7.1.30 docker-db form: shipped default SYS credential to PYTHON3 UDF os.popen command execution as uid=500(exadefusr), output returned in-band (8.8)
Posted by disclosure via Fulldisclosure on Oct 200day Rubbish Research Team is publicly disclosing a vulnerability in Exasol
Database 7.1.30, the in-memory MPP analytical database from Exasol AG
(Germany), examined in its docker-db single-container deployment form. The SQL
engine is a proprietary C implementation named EXASolution, the server process
is exacts, clients speak a proprietary binary SQL protocol on port 8563 rather
than HTTP, TLS terminates on that port with a self-signed...
