CVE-2013-4422: SQL Injection
Published Oct 23, 2013
·Updated
SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message.
Affected Software
109 affected components
Quassel-irc Quassel Irc<=0.9.0
Quassel-irc Quassel Irc=0.1.0
Quassel-irc Quassel Irc=0.3.0
Quassel-irc Quassel Irc=0.3.0.1
Quassel-irc Quassel Irc=0.3.0.2
Quassel-irc Quassel Irc=0.3.0.3
Quassel-irc Quassel Irc=0.3.1
Quassel-irc Quassel Irc=0.4.0
Quassel-irc Quassel Irc=0.4.1
Quassel-irc Quassel Irc=0.4.2
Quassel-irc Quassel Irc=0.4.3
Quassel-irc Quassel Irc=0.5.0
Quassel-irc Quassel Irc=0.6.1
Quassel-irc Quassel Irc=0.6.2
Quassel-irc Quassel Irc=0.6.3
Quassel-irc Quassel Irc=0.7.0
Quassel-irc Quassel Irc=0.7.1
Quassel-irc Quassel Irc=0.7.2
Quassel-irc Quassel Irc=0.7.3
Quassel-irc Quassel Irc=0.7.4
Quassel-irc Quassel Irc=0.8.0
PostgreSQL postgresql=8.2
PostgreSQL postgresql=8.2.1
PostgreSQL postgresql=8.2.2
PostgreSQL postgresql=8.2.3
PostgreSQL postgresql=8.2.4
PostgreSQL postgresql=8.2.5
PostgreSQL postgresql=8.2.6
PostgreSQL postgresql=8.2.7
PostgreSQL postgresql=8.2.8
PostgreSQL postgresql=8.2.9
PostgreSQL postgresql=8.2.10
PostgreSQL postgresql=8.2.11
PostgreSQL postgresql=8.2.12
PostgreSQL postgresql=8.2.13
PostgreSQL postgresql=8.2.14
PostgreSQL postgresql=8.2.15
PostgreSQL postgresql=8.2.16
PostgreSQL postgresql=8.2.17
PostgreSQL postgresql=8.2.18
PostgreSQL postgresql=8.3
PostgreSQL postgresql=8.3.1
PostgreSQL postgresql=8.3.2
PostgreSQL postgresql=8.3.3
PostgreSQL postgresql=8.3.4
PostgreSQL postgresql=8.3.5
PostgreSQL postgresql=8.3.6
PostgreSQL postgresql=8.3.7
PostgreSQL postgresql=8.3.8
PostgreSQL postgresql=8.3.9
PostgreSQL postgresql=8.3.10
PostgreSQL postgresql=8.3.11
PostgreSQL postgresql=8.3.12
PostgreSQL postgresql=8.3.13
PostgreSQL postgresql=8.3.14
PostgreSQL postgresql=8.3.15
PostgreSQL postgresql=8.3.16
PostgreSQL postgresql=8.3.17
PostgreSQL postgresql=8.3.18
PostgreSQL postgresql=8.3.19
PostgreSQL postgresql=8.3.20
PostgreSQL postgresql=8.3.21
PostgreSQL postgresql=8.3.22
PostgreSQL postgresql=8.4
PostgreSQL postgresql=8.4.1
PostgreSQL postgresql=8.4.2
PostgreSQL postgresql=8.4.3
PostgreSQL postgresql=8.4.4
PostgreSQL postgresql=8.4.5
PostgreSQL postgresql=8.4.6
PostgreSQL postgresql=8.4.7
PostgreSQL postgresql=8.4.8
PostgreSQL postgresql=8.4.9
PostgreSQL postgresql=8.4.10
PostgreSQL postgresql=8.4.11
PostgreSQL postgresql=8.4.12
PostgreSQL postgresql=8.4.13
PostgreSQL postgresql=8.4.14
PostgreSQL postgresql=8.4.15
PostgreSQL postgresql=8.4.16
PostgreSQL postgresql=9.0
PostgreSQL postgresql=9.0.1
PostgreSQL postgresql=9.0.2
PostgreSQL postgresql=9.0.3
PostgreSQL postgresql=9.0.4
PostgreSQL postgresql=9.0.5
PostgreSQL postgresql=9.0.6
PostgreSQL postgresql=9.0.7
PostgreSQL postgresql=9.0.8
PostgreSQL postgresql=9.0.9
PostgreSQL postgresql=9.0.10
PostgreSQL postgresql=9.0.11
PostgreSQL postgresql=9.0.12
PostgreSQL postgresql=9.1
PostgreSQL postgresql=9.1.1
PostgreSQL postgresql=9.1.2
PostgreSQL postgresql=9.1.3
PostgreSQL postgresql=9.1.4
PostgreSQL postgresql=9.1.5
PostgreSQL postgresql=9.1.6
PostgreSQL postgresql=9.1.7
PostgreSQL postgresql=9.1.8
PostgreSQL postgresql=9.2
PostgreSQL postgresql=9.2.1
PostgreSQL postgresql=9.2.2
PostgreSQL postgresql=9.2.3
Qt QT=4.8.5
Qt QT=5.0.0
Qt QT=5.0.1
Event History
Oct 23, 2013
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4422?
CVE-2013-4422 is classified as a medium severity SQL injection vulnerability.
2
How can I fix CVE-2013-4422?
To mitigate CVE-2013-4422, upgrade Quassel IRC to version 0.9.1 or later.
3
What systems are affected by CVE-2013-4422?
CVE-2013-4422 affects versions of Quassel IRC prior to 0.9.1 when using Qt 4.8.5 or later and PostgreSQL 8.2 or later.
4
What type of vulnerability is CVE-2013-4422?
CVE-2013-4422 is an SQL injection vulnerability.
5
Can remote attackers exploit CVE-2013-4422?
Yes, remote attackers can exploit CVE-2013-4422 to execute arbitrary SQL commands.