CVE-2009-4795

Multiple SQL injection vulnerabilities in Xlight FTP Server before 3.2.1, when ODBC authentication is enabled, allow remote attackers to execute arbitrary SQL commands via the (1) USER (aka username) or (2) PASS (aka password) command.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/34513	Vendor Advisory
http://www.securityfocus.com/bid/34288	Exploit Patch
http://www.xlightftpd.com/forum/viewtopic.php?t=1042	Exploit
http://www.xlightftpd.com/whatsnew.htm
https://exchange.xforce.ibmcloud.com/vulnerabilities/49495
http://secunia.com/advisories/34513	Vendor Advisory
http://www.securityfocus.com/bid/34288	Exploit Patch
http://www.xlightftpd.com/forum/viewtopic.php?t=1042	Exploit
http://www.xlightftpd.com/whatsnew.htm
https://exchange.xforce.ibmcloud.com/vulnerabilities/49495

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:xlightftpd:xlight_ftp_server::::::::
	cpe:2.3:a:xlightftpd:xlight_ftp_server:1.60:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:1.61:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:1.62:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:1.62a:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:1.64:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:1.65:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.0:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.01:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.1:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.2:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.02:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.03:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.8:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.24:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.27:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.40:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.60:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.70:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.72:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.82:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.83:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.85:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.86:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.706:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.835:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:2.861:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:3.0:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:3.0.5:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:3.1:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:3.1.1:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:3.1.5:::::::*
	cpe:2.3:a:xlightftpd:xlight_ftp_server:3.1.6:::::::*

History

21 Nov 2024, 01:10

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/34513 - Vendor Advisory~~	() http://secunia.com/advisories/34513 - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/34288 - Exploit, Patch~~	() http://www.securityfocus.com/bid/34288 - Exploit, Patch
References	~~() http://www.xlightftpd.com/forum/viewtopic.php?t=1042 - Exploit~~	() http://www.xlightftpd.com/forum/viewtopic.php?t=1042 - Exploit
References	~~() http://www.xlightftpd.com/whatsnew.htm -~~	() http://www.xlightftpd.com/whatsnew.htm -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/49495 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/49495 -

Information

Published : 2010-04-22 14:30

Updated : 2024-11-21 01:10

NVD link : CVE-2009-4795

Mitre link : CVE-2009-4795

CVE.ORG link : CVE-2009-4795

JSON object : View

Products Affected

xlightftpd

xlight_ftp_server

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2009-4795", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-04-22T14:30:00.637", "references": [{"url": "http://secunia.com/advisories/34513", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/34288", "tags": ["Exploit", "Patch"], "source": "cve@mitre.org"}, {"url": "http://www.xlightftpd.com/forum/viewtopic.php?t=1042", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.xlightftpd.com/whatsnew.htm", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49495", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/34513", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/34288", "tags": ["Exploit", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.xlightftpd.com/forum/viewtopic.php?t=1042", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.xlightftpd.com/whatsnew.htm", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49495", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Xlight FTP Server before 3.2.1, when ODBC authentication is enabled, allow remote attackers to execute arbitrary SQL commands via the (1) USER (aka username) or (2) PASS (aka password) command."}, {"lang": "es", "value": "Multiples vulnerabilidades de inyecci\u00f3n SQL en Xlight FTP Server en versiones anteriores a la v3.2.1, cuando la autenticaci\u00f3n ODBC est\u00e1 activada, permite a los usuarios remotos autenticados ejecutar comandos de su elecci\u00f3n SQL a trav\u00e9s del comando (1) USER (tambi\u00e9n conocido como username) o (2) PASS (password)."}], "lastModified": "2024-11-21T01:10:28.960", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34CEFF75-78C3-4BFD-9579-F35B2ED29958", "versionEndIncluding": "3.2"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:1.60:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A095E2BA-9DDC-4437-94AE-CD8E842D6537"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:1.61:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3428DC26-7F45-4BBB-9480-C853FB33A163"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:1.62:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCAAE010-65FB-498A-AA77-DD23CF69725A"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:1.62a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "227A5BC0-A51A-46AF-B35F-3688BAD799DF"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:1.64:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9174BB48-5BDF-4C25-9965-4F67D011B57D"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:1.65:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62EA1606-2C20-421C-978B-43A7B0C21DD9"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F174E30-6756-4F62-A1C4-A4D409892A62"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7427D271-0E83-4B5F-803C-DCB6A3504D35"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FB359DE-B6BC-4E7F-85FD-1A034565AC45"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51742984-DC6B-4501-923C-10DB5EAEEB91"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF7F8B1B-3F92-4CCE-9102-0EAF8E60A1E3"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.03:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A846A19-E22C-4DB1-942E-7AE0F725163B"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21FF9580-C032-474C-9A61-606BF65AD57F"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.24:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63E458AA-4D75-4244-9C11-FEC58F906724"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.27:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD52F83D-936D-4E07-97EF-4A54BD220FB5"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.40:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D87135DA-CB8B-446A-AFF2-DC4F397B46D6"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.60:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A7C99B8-4040-4D38-B2FA-EAC2FCFD6E2F"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.70:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27011F11-454F-4341-80F9-DFB6CB0A35CD"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.72:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51F052CF-4B88-43BB-8D27-8C230C82F8A9"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.82:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CE3F312-776C-489A-BAA1-A9B0F2D7EE77"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.83:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "834CA462-A3A9-4386-B9B0-DC30E6BB8723"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.85:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68003E26-4B5C-4F99-AA1D-4DB5EC317FDF"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.86:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "422F109F-8E69-4251-8C79-E0DD4DA7DD5D"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.706:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58AEC9D0-C4B9-45C5-A290-C2CA760691EE"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.835:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B0AD8CF-3162-4517-959A-9FF2EEBCB53D"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:2.861:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3DA9A959-2E9F-45FD-9C1A-D16E31074ED3"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5707DC3B-2DB8-456A-95B4-D80BFFEA320E"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:3.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CA12E92-2AC3-4F7E-BAF7-D92AF88A84CA"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C04AC89-8ABB-46BA-84CE-B2DDFC6294D8"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:3.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C94759C-5E4D-464F-9750-82E580740B60"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:3.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "790674EF-8E04-439F-BD20-463E25081AD2"}, {"criteria": "cpe:2.3:a:xlightftpd:xlight_ftp_server:3.1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41683325-DE0B-4D22-8AF0-1A48D3CB651A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

6.8 /10