BMC Control-M/MFT SQL Injection Vulnerability in Debug Interface Allowing Arbitrary File Operations and Potential Remote Code Execution

A SQL injection vulnerability has been identified in the debug interface of the MFT API within BMC Control-M/MFT versions 9.0.20 through 9.0.22. This vulnerability allows authenticated attackers to inject malicious SQL queries due to inadequate input validation and unsafe dynamic SQL processing. Exploitation of this issue could enable unauthorized reading or writing of files and may lead to remote code execution.

Impact

Exploitation of this vulnerability could result in unauthorized file read/write operations and potentially allow for remote code execution.

Remediation

Users can upgrade to BMC Control-M/MFT patch PAAFP.9.0.22.025 to address this vulnerability. Instructions for installing this patch on both UNIX and Windows systems are available in the BMC Control-M documentation.