CVE-2012-0811

Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.

Published Bysecalert@redhat.com

Published DateOct 01, 2014, 14:55

Weakness Type (CWE):CWE-89

CVSS Metrics

Base Score

6.5

Vector String

AV:N/AC:L/Au:S/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://www.codseq.it/advisories/multiple_vulnerabilities_in_postfixadmin
http://www.openwall.com/lists/oss-security/2012/01/26/5
http://www.openwall.com/lists/oss-security/2012/01/27/5
http://www.securityfocus.com/bid/51680
https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3/CHANGELOG.TXT

Weakness Type (CWE):CWE-89

CVSS Metrics

Base Score

6.5

Vector String

AV:N/AC:L/Au:S/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL