NGSSoftware Insight Security Research Advisory – Informix Dynamic Server is a database developed by IBM. During a security assessment of Informix multiple arbitrary command execution flaws were found. It is possible to inject arbitrary operating system commands into the SET DEBUG FILE SQL statement and the start_onpload and dbexp procedures. Any commands injected into SET DEBUG FILE will execute with the privileges of the informix user; any command injected into dbexp or start_onpload will execute with the privileges of the logged on user. All versions are affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/49298/NISR02082006F.txt
Source: https://packetstormsecurity.com/files/49298/NISR02082006F.txt.html