The sapdbwa_GetUserData function in MySQL MaxDB 7.5.0.0 and other versions before 7.5.0.21 allows remote attackers to cause a denial of service (crash) via invalid parameters to the WebDAV handler code which triggers a null dereference that causes the SAP DB Web Agent to crash.