7.5

CVE-2013-5697

Exploit
SQL injection vulnerability in mod_accounting.c in the mod_accounting module 0.5 and earlier for Apache allows remote attackers to execute arbitrary SQL commands via a Host header.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Simone Tellini ≫ Mod Accounting Version <= 0.5
   Apache ≫ HTTP Server Version 1.3
   Apache ≫ HTTP Server Version 1.3.0
   Apache ≫ HTTP Server Version 1.3.1
   Apache ≫ HTTP Server Version 1.3.1.1
   Apache ≫ HTTP Server Version 1.3.2
   Apache ≫ HTTP Server Version 1.3.3
   Apache ≫ HTTP Server Version 1.3.4
   Apache ≫ HTTP Server Version 1.3.5
   Apache ≫ HTTP Server Version 1.3.6
   Apache ≫ HTTP Server Version 1.3.7
   Apache ≫ HTTP Server Version 1.3.8
   Apache ≫ HTTP Server Version 1.3.9
   Apache ≫ HTTP Server Version 1.3.10
   Apache ≫ HTTP Server Version 1.3.11
   Apache ≫ HTTP Server Version 1.3.12
   Apache ≫ HTTP Server Version 1.3.13
   Apache ≫ HTTP Server Version 1.3.14
   Apache ≫ HTTP Server Version 1.3.15
   Apache ≫ HTTP Server Version 1.3.16
   Apache ≫ HTTP Server Version 1.3.17
   Apache ≫ HTTP Server Version 1.3.18
   Apache ≫ HTTP Server Version 1.3.19
   Apache ≫ HTTP Server Version 1.3.20
   Apache ≫ HTTP Server Version 1.3.22
   Apache ≫ HTTP Server Version 1.3.23
   Apache ≫ HTTP Server Version 1.3.24
   Apache ≫ HTTP Server Version 1.3.25
   Apache ≫ HTTP Server Version 1.3.26
   Apache ≫ HTTP Server Version 1.3.27
   Apache ≫ HTTP Server Version 1.3.28
   Apache ≫ HTTP Server Version 1.3.29
   Apache ≫ HTTP Server Version 1.3.30
   Apache ≫ HTTP Server Version 1.3.31
   Apache ≫ HTTP Server Version 1.3.32
   Apache ≫ HTTP Server Version 1.3.33
   Apache ≫ HTTP Server Version 1.3.34
   Apache ≫ HTTP Server Version 1.3.35
   Apache ≫ HTTP Server Version 1.3.36
   Apache ≫ HTTP Server Version 1.3.37
   Apache ≫ HTTP Server Version 1.3.38
   Apache ≫ HTTP Server Version 1.3.39
   Apache ≫ HTTP Server Version 1.3.41
   Apache ≫ HTTP Server Version 1.3.42
   Apache ≫ HTTP Server Version 1.3.65
   Apache ≫ HTTP Server Version 1.3.68
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.39% 0.698
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

http://osvdb.org/97588
http://www.baesystemsdetica.com.au/Research/Advisories/mod_accounting-Blind-SQL-Injection-%28DS-2013-006%29
Exploit