PT-2015-6225 · Postgresql Global Development Group+2 · Postgresql+2
Pierre Schweitzer
·
Publicado
2015-04-30
·
Atualizado
2021-06-28
·
CVE-2015-3427
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Quassel versions prior to 0.12.2
Description
The issue arises when the PostgreSQL database is restarted, and Quassel does not properly re-initialize the database session. This allows remote attackers to conduct SQL injection attacks via a backslash (``) in a message.
Recommendations
For Quassel versions prior to 0.12.2, update to version 0.12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the database or limiting the use of backslashes in messages until the update is applied.
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Postgresql
Quassel