Microsoft SharePoint SQL Injection Vulnerability Leading to Remote Code Execution

A SQL injection vulnerability has been identified in Microsoft Office SharePoint, allowing an authorized attacker to execute code remotely. This issue arises from improper neutralization of special elements used in SQL commands. The vulnerability affects multiple SharePoint versions, including SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.

Impact

Exploitation of this vulnerability could allow an authenticated attacker with Site Member permissions to execute code remotely on the affected SharePoint server.

Remediation

Users can apply the security updates provided by Microsoft to address this vulnerability. These security updates are available through the Microsoft Update Catalog.