CVE-2013-7262: SQL Injection
Published Jan 5, 2014
·Updated
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
Affected Software
62 affected components
OSGeo MapServer<=6.4.0
OSGeo MapServer=4.2.0-beta1
OSGeo MapServer=4.4.0
OSGeo MapServer=4.4.0-beta1
OSGeo MapServer=4.4.0-beta2
OSGeo MapServer=4.4.0-beta3
OSGeo MapServer=4.6.0
OSGeo MapServer=4.6.0-beta1
OSGeo MapServer=4.6.0-beta2
OSGeo MapServer=4.6.0-beta3
OSGeo MapServer=4.6.0-rc1
OSGeo MapServer=4.8.0-beta1
OSGeo MapServer=4.8.0-beta2
OSGeo MapServer=4.8.0-beta3
OSGeo MapServer=4.8.0-rc1
OSGeo MapServer=4.8.0-rc2
OSGeo MapServer=4.10.0
OSGeo MapServer=4.10.0-beta1
OSGeo MapServer=4.10.0-beta2
OSGeo MapServer=4.10.0-beta3
OSGeo MapServer=4.10.0-rc1
OSGeo MapServer=4.10.1
OSGeo MapServer=4.10.2
OSGeo MapServer=4.10.3
OSGeo MapServer=4.10.4
OSGeo MapServer=4.10.5
OSGeo MapServer=5.0.0
OSGeo MapServer=5.0.0-beta1
OSGeo MapServer=5.0.0-beta2
OSGeo MapServer=5.0.0-beta3
OSGeo MapServer=5.0.0-beta4
OSGeo MapServer=5.0.0-beta5
OSGeo MapServer=5.0.0-beta6
OSGeo MapServer=5.0.0-rc1
OSGeo MapServer=5.0.0-rc2
OSGeo MapServer=5.2.0
OSGeo MapServer=5.2.0-beta1
OSGeo MapServer=5.2.0-beta2
OSGeo MapServer=5.2.0-beta3
OSGeo MapServer=5.2.0-beta4
OSGeo MapServer=5.2.0-rc1
OSGeo MapServer=5.2.1
OSGeo MapServer=5.4.0
OSGeo MapServer=5.4.0-beta1
OSGeo MapServer=5.4.0-beta2
OSGeo MapServer=5.4.0-beta3
OSGeo MapServer=5.4.0-beta4
OSGeo MapServer=5.4.0-rc1
OSGeo MapServer=5.4.0-rc2
OSGeo MapServer=5.4.1
OSGeo MapServer=5.4.2
OSGeo MapServer=5.6.0
OSGeo MapServer=5.6.1
OSGeo MapServer=5.6.3
OSGeo MapServer=6.0.1
OSGeo MapServer=6.0.2
OSGeo MapServer=6.0.3
OSGeo MapServer=6.2.0
OSGeo MapServer=6.2.1
Umn Mapserver=5.2.3
Umn Mapserver=5.6.7
Umn Mapserver=6.0.0
Event History
Jan 5, 2014
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Data Sourced
via NVD·08:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-7262?
CVE-2013-7262 is classified as a medium severity vulnerability that allows SQL injection via crafted strings.
2
How do I fix CVE-2013-7262?
To fix CVE-2013-7262, upgrade to MapServer version 6.4.1 or later.
3
What are the affected versions for CVE-2013-7262?
CVE-2013-7262 affects MapServer versions earlier than 6.4.1, including several beta and release candidates.
4
Can CVE-2013-7262 be exploited remotely?
Yes, CVE-2013-7262 can be exploited remotely by attackers via a crafted WMS-Time service request.
5
What type of vulnerability is CVE-2013-7262?
CVE-2013-7262 is an SQL injection vulnerability that allows arbitrary SQL command execution.