MapServer PostGIS TIME Filter SQL Injection Vulnerability
BID:64671
Info
MapServer PostGIS TIME Filter SQL Injection Vulnerability
| Bugtraq ID: | 64671 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-7262 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 06 2014 12:00AM |
| Updated: | May 12 2015 07:53PM |
| Credit: | Even Rouault |
| Vulnerable: |
Regents of the University of Minnesota MapServer 6.4 |
| Not Vulnerable: |
Regents of the University of Minnesota MapServer 6.4.1 |
Discussion
MapServer PostGIS TIME Filter SQL Injection Vulnerability
MapServer is prone to an SQL-injection vulnerability.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to MapServer 6.4.1 are vulnerable.
MapServer is prone to an SQL-injection vulnerability.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to MapServer 6.4.1 are vulnerable.
Exploit / POC
MapServer PostGIS TIME Filter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
MapServer PostGIS TIME Filter SQL Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information
Solution:
Updates are available. Please see the references or vendor advisory for more information
References
MapServer PostGIS TIME Filter SQL Injection Vulnerability
References:
References:
- MapServer Homepage (Regents of the University of Minneso)