Proof of Concept for Microsoft SQL Server Reporting Services Vulnerability (CVE-2020-0618)

As part of February 2020’s Patch Tuesday, Microsoft issued a patch for CVE-2020-0618, an improper input validation vulnerability in the ReportingServicesWebServer.dll of Microsoft SQL Server Reporting Services.

The vulnerability was discovered and reported to Microsoft by Soroush Dalili, principal security consultant at MDSec. Dalili published a blog post regarding his findings, which included a proof-of-concept for the vulnerability.

SQL Server Reporting Services is not part of the default installation of Microsoft SQL Server, but there are some software packages that include it. 

For more information about the vulnerability, including patch details, please visit our blog.