CVE-2020-6253: 
SAP Adaptive Server Enterprise vulnerability analysis and mitigation

SAP Adaptive Server Enterprise (ASE) versions 15.7 and 16.0 were found to contain a critical SQL injection vulnerability (CVE-2020-6253) disclosed in May 2020. Under certain conditions, this vulnerability allows an authenticated user with database owner privileges to execute crafted database queries to elevate their privileges, modify database objects, or execute unauthorized commands through SQL injection in the WebServices component (NVD, Bleeping Computer).

The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The flaw exists in the WebServices handling code of ASE and specifically affects database owners who can exploit it through SQL injection to gain elevated privileges (Bleeping Computer, Threatpost).

If successfully exploited, the vulnerability allows authenticated users to elevate their privileges to administrator level, modify database objects, and execute unauthorized commands. This could potentially lead to complete compromise of the database system (Hacker News).

The vulnerability requires an authenticated user with database owner privileges to exploit. It can be triggered through crafted database queries targeting the WebServices component (NVD).

SAP released patches for this vulnerability in their May 2020 security update. Organizations using SAP ASE versions 15.7 and 16.0 are strongly advised to apply these security patches immediately (Bleeping Computer).