Which vulnerability allows an attacker to execute shell commands on an IIS server by constructing SQL statements?

Which vulnerability allows an attacker to execute shell commands on an IIS server by constructing SQL statements?

• A. Unicode attack vulnerability enabling scripts to run in restricted folders
• B. RDS vulnerability that allows constructing SQL statements to execute shell commands on the IIS server
• C. Msadcs.dll vulnerability that directly executes code
• D. SQL injection vulnerability that does not involve RDS

Answer: (B)

This question focuses on how an attacker can reach the underlying operating system from a web server by using SQL statements. When Remote Data Services (RDS) is misconfigured, an attacker can craft SQL that leverages server-side commands to run OS-level operations (for example, using xp_cmdshell or similar extended procedures). This means the attacker can execute shell commands on the IIS host itself, effectively gaining command-shell access through the database layer. The described path—constructing SQL statements that trigger OS commands on the IIS server via RDS—fits this vulnerability exactly. Other options describe different issues (Unicode/script execution in folders, a DLL-based code execution vulnerability, or SQL injection that doesn’t involve RDS), none of which specifically capture the scenario of running shell commands on the server through SQL statements.

This question focuses on how an attacker can reach the underlying operating system from a web server by using SQL statements. When Remote Data Services (RDS) is misconfigured, an attacker can craft SQL that leverages server-side commands to run OS-level operations (for example, using xp_cmdshell or similar extended procedures). This means the attacker can execute shell commands on the IIS host itself, effectively gaining command-shell access through the database layer.

The described path—constructing SQL statements that trigger OS commands on the IIS server via RDS—fits this vulnerability exactly. Other options describe different issues (Unicode/script execution in folders, a DLL-based code execution vulnerability, or SQL injection that doesn’t involve RDS), none of which specifically capture the scenario of running shell commands on the server through SQL statements.