Wabisabilabi sells SAP remote exploit

A vulnerability that affects SAP's MaxDB hasn't garnered any bids yet on a controversial auction site for computer vulnerabilities.

If exploited, the problem would let an attacker access the entire contents of the database, according to Wabisabilabi, which is offering proof-of-concept code and details on its vulnerability auction site. Bidding starts at €3,000 (US$4,407).

"The result can be scary," said Wabisabilabi on its blog.

Wabisabilabi, based in Switzerland, started its vulnerability auction site in July on the premise that security researchers aren't adequately compensated for their work and could sell zero-day vulnerabilities on the black market.

Wabisabilabi's site lets security researchers submit vulnerabilities for auction. Wabisabilabi said it will only sell vulnerabilities to qualified researchers who aren't going to do anything malicious. Nonetheless, the security community has questioned whether Wabisabilabi's business premise is ethical.

According to Wabisabilabi's blog, the MaxDB vulnerability is easy to exploit. It affects Linux machines running the latest version of MaxDB, 7.6.00.37, and Windows machines running version 7.6.00.37. The problem could also affect other versions of the database.

An attacker could send a specially crafted request to the listening port of the vulnerable MaxDB service. The command would be executed with the credentials of the user running the process. Then, an attacker could "dump the content of the whole database," Wabisabilabi wrote.

Wabisabilabi said it's rare to find a database running open on the Internet, but more common within corporate intranets.

An SAP official contacted in Germany did not have an immediate comment.