A trio of researchers from Palo Alto Networks has detailed vulnerabilities in the JET Engine database present on millions of Windows machines and demonstrated how they can be used to attack SQL server and Microsoft’s Internet Information Server as if attackers had the ability to execute code on the systems and said Microsoft has dismissed some of their findings as not worthy of a fix. In a talk today at Black Hat Asia titled “Give Me a SQL Injection, I Shall PWN IIS and SQL Server”, the three explained that they’ve found the JET database engine – for years supplied as the underlying tech for Microsoft Access and still downloadable today – has many vulnerabilities.

Read full article on The Register