CVE-2008-2384 SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allow...
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| joey schulze mod auth mysql | All versions | No fix listed |
References
- klecker.debian.org patch
- FEDORA-2011-0100 vendor-advisory
- FEDORA-2011-0114 vendor-advisory
- [oss-security] 20090121 mod-auth-mysql: SQL injection mailing-list
- 33627 third-party-advisory vendor-advisory
- 43302 third-party-advisory
- RHSA-2009:0259 vendor-advisory
- RHSA-2010:1002 vendor-advisory
- 33392 vdb-entry
- ADV-2009-0226 vdb-entry
- ADV-2011-0367 vdb-entry
- bugzilla.redhat.com
- modauthmysql-multibyte-sql-injection(48163) vdb-entry
- oval:org.mitre.oval:def:10172 signature vdb-entry