CVE-2003-0500: SQL Injection

Published Jul 4, 2003

Updated

SQL injection vulnerability in the PostgreSQL authentication module (modsqlpostgres) for ProFTPD before 1.2.9rc1 allows remote attackers to execute arbitrary SQL and gain privileges by bypassing authentication or stealing passwords via the USER name.

Affected Software

1 affected component

Proftpd Project Proftpd=1.2.9_rc1

Remediation

Patch Available

http://www.debian.org/security/2003/dsa-338

Event History

Jul 4, 2003

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Aug 7, 2003

Data Sourced

via NVD·04:00 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2003-0500?

CVE-2003-0500 is considered a critical vulnerability due to its potential for remote exploitation and unauthorized access.

How do I fix CVE-2003-0500?

To fix CVE-2003-0500, upgrade to ProFTPD version 1.2.9rc1 or later, which patches this SQL injection issue.

What types of attacks can be executed using CVE-2003-0500?

Exploiting CVE-2003-0500 allows attackers to execute arbitrary SQL commands, potentially bypassing authentication and stealing passwords.

Which software is affected by CVE-2003-0500?

CVE-2003-0500 affects ProFTPD versions before 1.2.9rc1 that use the PostgreSQL authentication module.

Can CVE-2003-0500 be exploited remotely?

Yes, CVE-2003-0500 can be exploited remotely, allowing attackers to gain unauthorized access to the system.