CVE-2014-2323

CRITICAL · 9.8 CVSS Gepubliceerd: 14-03-2014 CWE-89

Beschrijving

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Vendors

Lighttpd Debian Opensuse Suse

Affected products

Lighttpd Debian Linux Opensuse Linux Enterprise High Availability Extension Linux Enterprise Software Development Kit

References

download.lighttpd.net
jvn.jp
lists.opensuse.org
lists.opensuse.org
lists.opensuse.org
marc.info
seclists.org
seclists.org
secunia.com
secunia.com
www.debian.org
www.lighttpd.net