VulnerabilityModified
CVE-2008-6992
GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.9.4, allows remote attackers to bypass the SQL injection protection mechanism via a WHERE clause containing an expression such as "x=y=z", which is successfully parsed by MySQL.
HIGH 7.5EPSS 1.38%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.9.4, allows remote attackers to bypass the SQL injection protection mechanism via a WHERE clause containing an expression such as "x=y=z", which is successfully parsed by MySQL.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.38% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- greensql/greensql firewall
- Source
- cve@mitre.org
References
- http://bugs.mysql.com/bug.php?id=39337Exploit
- http://osvdb.org/48910Exploit
- http://sla.ckers.org/forum/read.php?16%2C24367
- http://www.greensql.net/node/89Patch
- http://www.greensql.net/node/98Patch
- http://www.greensql.net/securityVendor Advisory
- http://bugs.mysql.com/bug.php?id=39337Exploit
- http://osvdb.org/48910Exploit
- http://sla.ckers.org/forum/read.php?16%2C24367
- http://www.greensql.net/node/89Patch
- http://www.greensql.net/node/98Patch
- http://www.greensql.net/securityVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.