Description
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
References (4)
Core 4
Core References
Vendor Advisory x_refsource_confirm
http://www.mapserver.org/development/changelog/changelog-6-4.html#changelog-6-4-1
Issue Tracking x_refsource_confirm
https://github.com/mapserver/mapserver/issues/4834
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/64671
Patch x_refsource_confirm
https://github.com/mapserver/mapserver/commit/3a10f6b829297dae63492a8c63385044bc6953ed
Scores
EPSS
0.0222
EPSS Percentile
80.8%
Details
CWE
CWE-89
Status
published
Products (16)
osgeo/mapserver
4.2.0 beta1
osgeo/mapserver
4.4.0 (4 CPE variants)
osgeo/mapserver
4.6.0 (5 CPE variants)
osgeo/mapserver
4.8.0 beta1 (5 CPE variants)
osgeo/mapserver
4.10.0 (5 CPE variants)
osgeo/mapserver
4.10.1
osgeo/mapserver
4.10.2
osgeo/mapserver
4.10.3
osgeo/mapserver
4.10.4
osgeo/mapserver
4.10.5
... and 6 more
Published
Jan 05, 2014
Tracked Since
Feb 18, 2026