CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 9.0
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: a sql injection remote code execution vulnerability in trend micro smart protection server (standalone) 3.x could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw within the handling of parameters provided to wcs\_bwlists\_handler.php.  authentication is required in order to exploit this vulnerability.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2018-05-25
Last Modified Date: 2018-06-25