CVE-2008-2384: SQL Injection
Martin Joey Schulze discovered a flaw in the way modauthmysql handles certain multibyte character encodings.
If modauthmysql is configured to use use a multibyte character set that allows the backslash '\' character as part of the character encodings, it is possible to inject arbitrary SQL commands to the MySQL database server.
Other sources
SQL injection vulnerability in modauthmysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2384?
CVE-2008-2384 is considered a high severity vulnerability due to its potential to allow SQL injection.
How do I fix CVE-2008-2384?
To fix CVE-2008-2384, update to a patched version of mod_auth_mysql that addresses the multibyte character encoding flaw.
What impact does CVE-2008-2384 have?
CVE-2008-2384 may allow attackers to execute arbitrary SQL queries, compromising database integrity and security.
Which software is affected by CVE-2008-2384?
CVE-2008-2384 specifically affects mod_auth_mysql used alongside the Apache HTTP Server.
How can I identify if I'm vulnerable to CVE-2008-2384?
You can identify vulnerability to CVE-2008-2384 by checking if your installation of mod_auth_mysql uses multibyte character sets permitting the backslash '\'.