Microsoft Configuration Manager SQL Injection Vulnerability Allowing Privilege Escalation

A SQL injection vulnerability has been identified in Microsoft Configuration Manager, specifically in versions 2403, 2503, and 2409. This vulnerability allows an unauthorized attacker to inject malicious SQL, potentially leading to elevated privileges. The issue arises in the 'DuplicateAMTMachineRecord' method, where special elements are not properly neutralized, enabling local privilege escalation.

Impact

Exploitation of this vulnerability could allow an unauthorized attacker to gain administrative privileges within Microsoft Configuration Manager.

Remediation

Users can download the security update for Microsoft Configuration Manager 2403, 2503, or 2409 through the Microsoft Update Catalog.