CVE-2012-0811
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2)…
Does this matter?
Lower severity and a low EPSS score (1.68%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 1.68% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- postfix/postfix
- Source
- secalert@redhat.com
References
- http://www.codseq.it/advisories/multiple_vulnerabilities_in_postfixadminExploit
- http://www.openwall.com/lists/oss-security/2012/01/26/5
- http://www.openwall.com/lists/oss-security/2012/01/27/5
- http://www.securityfocus.com/bid/51680
- https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3/CHANGELOG.TXT
- http://www.codseq.it/advisories/multiple_vulnerabilities_in_postfixadminExploit
- http://www.openwall.com/lists/oss-security/2012/01/26/5
- http://www.openwall.com/lists/oss-security/2012/01/27/5
- http://www.securityfocus.com/bid/51680
- https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3/CHANGELOG.TXT
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.