PT-2013-5733 · Apache · Apache Mod Accounting Module

Publicado 2013-09-30 · Atualizado 2013-10-11 · CVE-2013-5697

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache mod accounting module version 0.5 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting a SQL injection vulnerability in the mod accounting.c file within the mod accounting module for Apache. The vulnerability can be triggered via a Host header.

Recommendations For Apache mod accounting module version 0.5 and earlier, consider updating to a version later than 0.5 to resolve the issue. As a temporary workaround, restrict access to the mod accounting module to minimize the risk of exploitation. Avoid using the Host header in a way that could trigger the SQL injection until the issue is resolved.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-5697

Produtos afetados

Apache Mod Accounting Module

Referências · 5

• 🔥 http://baesystemsdetica.com.au/Research/Advisories/mod_accounting-Blind-SQL-Injection-%28DS-2013-006%29 · Exploit
• 🔥 https://exploit-db.com/exploits/28653 · Exploit
• http://osvdb.org/97588 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5697 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5697 · Nota