CVE-2011-2688

EXPLOITED

mod_authnz_external < 3.2.5 - SQL Injection via User Field

Title source: llm

Exploitation Summary

CVE-2011-2688 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.

References (9)

Core 9

Core References

Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633637

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2011/07/12/10

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/48653

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/45240

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2011/dsa-2279

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/68799

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2011/07/12/17

Third Party Advisory x_refsource_confirm

http://code.google.com/p/mod-auth-external/issues/detail?id=5

Third Party Advisory x_refsource_misc

http://anders.fix.no/software/#unix

Scores

EPSS 0.0566

EPSS Percentile 92.1%

Details

VulnCheck KEV 2025-02-07

CWE

CWE-89

Status published

Products (4)

debian/debian_linux 5.0

debian/debian_linux 6.0

debian/debian_linux 7.0

mod_authnz_external_project/mod_authnz_external < 3.2.5

Published Jul 28, 2011

Tracked Since Feb 18, 2026