CVE-2003-0938: SAP DB

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

vos24u.c in SAP database server (SAP DB) 7.4.03.27 and earlier allows local users to gain SYSTEM privileges via a malicious "NETAPI32.DLL" in the current working directory, which is found and loaded by SAP DB before the real DLL, as demonstrated using the SQLAT stored procedure.

Affected products

• SAP SAP DB: up to and including 7.4.03.27

Published 2003-12-15. Last modified 2026-06-16.