CVE-2008-2667

Courier Authentication Library < 0.60.6 - SQL Injection via Username Parameter

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in the Courier Authentication Library (aka courier-authlib) before 0.60.6 on SUSE openSUSE 10.3 and 11.0, and other platforms, when MySQL and a non-Latin character set are used, allows remote attackers to execute arbitrary SQL commands via the username and unspecified other vectors.

References (9)

Core 9
Core References
Various Sources mailing-list x_refsource_mlist
http://www.nabble.com/courier-authlib-0.60.6-released-td17720739.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30591
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43628
Issue Tracking x_refsource_confirm
http://bugs.gentoo.org/show_bug.cgi?id=225407
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30967
Various Sources x_refsource_confirm
http://www.courier-mta.org/authlib/changelog.html
Vendor Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200809-05.xml

Scores

EPSS 0.0153
EPSS Percentile 72.1%

Details

CWE
CWE-89
Status published
Products (17)
courier-mta/courtier-authlib 0.52
courier-mta/courtier-authlib 0.53
courier-mta/courtier-authlib 0.54
courier-mta/courtier-authlib 0.55
courier-mta/courtier-authlib 0.56
courier-mta/courtier-authlib 0.57
courier-mta/courtier-authlib 0.58
courier-mta/courtier-authlib 0.59
courier-mta/courtier-authlib 0.59.1
courier-mta/courtier-authlib 0.59.2
... and 7 more
Published Jul 07, 2008
Tracked Since Feb 18, 2026