PT-2011-4029 · Mysql Server+1 · Mysql Server+2
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
mod authnz external module versions 3.2.5 and earlier
Description
The issue allows remote attackers to execute arbitrary SQL commands via the
user field. This is related to a SQL injection vulnerability in the mysql/mysql-auth.pl script. The vulnerability affects the Apache HTTP Server. There are reports of threats including FinStealer and Rewardsteal, with victims in the education and financial industries, particularly in India.Recommendations
For mod authnz external module versions 3.2.5 and earlier, consider disabling the vulnerable mysql/mysql-auth.pl script until a patch is available. Restrict access to the
user field in the affected module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Http Server
Mod Authnz External
Mysql Server