cve/cves/2020/CVE-2020-0618.md

CVE-2020-0618

Description

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

POC

Reference

• http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html
• http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html

Github

• https://github.com/euphrat1ca/CVE-2020-0618
• https://github.com/wortell/cve-2020-0618

Nuclei

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-0618.yaml

ExploitDB

• https://www.exploit-db.com/exploits/48816

Metasploit

• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ssrs_navcorrector_viewstate.rb