CVE-2017-17656

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackup JobList method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4292.

• CWE-89
• CWE-89

• https://zerodayinitiative.com/advisories/ZDI-17-992Third Party Advisory, VDB Entry
• https://zerodayinitiative.com/advisories/ZDI-17-992Third Party Advisory, VDB Entry

Published

Feb 8, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1765IBM Business Process Manager 8.6 could allow an authenticate…3.1
• CVE-2017-17651Paid To Read Script 2.0.5 has SQL Injection via the admin/us…
• CVE-2017-17652This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17653This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17654This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17655This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17657This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17658This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-17659This vulnerability allows remote attackers to execute arbitr…
• CVE-2017-1766Due to incorrect authorization in IBM Business Process Manag…4.3
• CVE-2017-17662Directory traversal in the HTTP server on Yawcam 0.2.6 throu…
• CVE-2017-17663The htpasswd implementation of mini_httpd before v1.28 and o…