CVE-2013-7262 SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL com...
MediumCVSS 6.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mapserver(Debian:12) | < 6.4.1-1 | 6.4.1-1 |
| debian/mapserver(Debian:13) | < 6.4.1-1 | 6.4.1-1 |
| debian/mapserver(Debian:14) | < 6.4.1-1 | 6.4.1-1 |
| osgeo mapserver | <= 6.4.0 | No fix listed |
| osgeo mapserver | = 4.2.0-beta1 | No fix listed |
| osgeo mapserver | = 4.4.0 | No fix listed |
| osgeo mapserver | = 4.4.0-beta1 | No fix listed |
| osgeo mapserver | = 4.4.0-beta2 | No fix listed |
| osgeo mapserver | = 4.4.0-beta3 | No fix listed |
| osgeo mapserver | = 4.6.0 | No fix listed |
| osgeo mapserver | = 4.6.0-beta1 | No fix listed |
| osgeo mapserver | = 4.6.0-beta2 | No fix listed |
| osgeo mapserver | = 4.6.0-beta3 | No fix listed |
| osgeo mapserver | = 4.6.0-rc1 | No fix listed |
| osgeo mapserver | = 4.8.0-beta1 | No fix listed |
| osgeo mapserver | = 4.8.0-beta2 | No fix listed |
| osgeo mapserver | = 4.8.0-beta3 | No fix listed |
| osgeo mapserver | = 4.8.0-rc1 | No fix listed |
| osgeo mapserver | = 4.8.0-rc2 | No fix listed |
| osgeo mapserver | = 4.10.0 | No fix listed |
| osgeo mapserver | = 4.10.0-beta1 | No fix listed |
| osgeo mapserver | = 4.10.0-beta2 | No fix listed |
| osgeo mapserver | = 4.10.0-beta3 | No fix listed |
| osgeo mapserver | = 4.10.0-rc1 | No fix listed |
| osgeo mapserver | = 4.10.1 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| osgeo mapserver | = 4.10.2 | No fix listed |
| osgeo mapserver | = 4.10.3 | No fix listed |
| osgeo mapserver | = 4.10.4 | No fix listed |
| osgeo mapserver | = 4.10.5 | No fix listed |
| osgeo mapserver | = 5.0.0 | No fix listed |
| osgeo mapserver | = 5.0.0-beta1 | No fix listed |
| osgeo mapserver | = 5.0.0-beta2 | No fix listed |
| osgeo mapserver | = 5.0.0-beta3 | No fix listed |
| osgeo mapserver | = 5.0.0-beta4 | No fix listed |
| osgeo mapserver | = 5.0.0-beta5 | No fix listed |
| osgeo mapserver | = 5.0.0-beta6 | No fix listed |
| osgeo mapserver | = 5.0.0-rc1 | No fix listed |
| osgeo mapserver | = 5.0.0-rc2 | No fix listed |
| osgeo mapserver | = 5.2.0 | No fix listed |
| osgeo mapserver | = 5.2.0-beta1 | No fix listed |
| osgeo mapserver | = 5.2.0-beta2 | No fix listed |
| osgeo mapserver | = 5.2.0-beta3 | No fix listed |
| osgeo mapserver | = 5.2.0-beta4 | No fix listed |
| osgeo mapserver | = 5.2.0-rc1 | No fix listed |
| osgeo mapserver | = 5.2.1 | No fix listed |
| osgeo mapserver | = 5.4.0 | No fix listed |
| osgeo mapserver | = 5.4.0-beta1 | No fix listed |
| osgeo mapserver | = 5.4.0-beta2 | No fix listed |
| osgeo mapserver | = 5.4.0-beta3 | No fix listed |
| osgeo mapserver | = 5.4.0-beta4 | No fix listed |
| osgeo mapserver | = 5.4.0-rc1 | No fix listed |
| osgeo mapserver | = 5.4.0-rc2 | No fix listed |
| osgeo mapserver | = 5.4.1 | No fix listed |
| osgeo mapserver | = 5.4.2 | No fix listed |
| osgeo mapserver | = 5.6.0 | No fix listed |
| osgeo mapserver | = 5.6.1 | No fix listed |
| osgeo mapserver | = 5.6.3 | No fix listed |
| osgeo mapserver | = 6.0.1 | No fix listed |
| osgeo mapserver | = 6.0.2 | No fix listed |
| osgeo mapserver | = 6.0.3 | No fix listed |
| osgeo mapserver | = 6.2.0 | No fix listed |
| osgeo mapserver | = 6.2.1 | No fix listed |
| umn mapserver | = 5.2.3 | No fix listed |
| umn mapserver | = 5.6.7 | No fix listed |
| umn mapserver | = 6.0.0 | No fix listed |
References
- Debian Security Tracker CVE-2013-7262 vendor-advisory
- www.mapserver.org vendor-advisory
- 64671 vdb-entry
- github.com
- github.com
- bugs.debian.org issue-tracking