CVE-2012-0811 — SQL Injection in Postfixadmin

CWE-89 — SQL Injection4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 33.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
PostfixadminDebian PostfixadminPostfix
Timeline
PublishedOct 1
Latest updateMay 17

Description

Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 8.0 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/postfixadmin< postfixadmin 2.3.5-1 (bookworm)
▶Debianpostfixadmin/postfixadmin< 2.3.5-1+2
▶NVDpostfix/postfix2.3.4+44

🔴Vulnerability Details

2
GHSA
GHSA-49m4-v772-g49w: Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2↗2022-05-17
▶
OSV
CVE-2012-0811: Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2↗2014-10-01
▶

📋Vendor Advisories

1
Debian
CVE-2012-0811: postfixadmin - Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) befor...↗2012
▶