CVE-2018-16384

HIGH

OWASP ModSecurity Core Rule Set <= 3.1.0-rc3 - SQL Injection via PL1 Bypass with Special Function Names

Title source: llm

Description

A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1167

Mailing List mailing-list

https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html

Scores

CVSS v3 7.5

EPSS 0.0167

EPSS Percentile 74.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-89

Status published

Products (2)

owasp/owasp_modsecurity_core_rule_set 3.1.0 rc1 (2 CPE variants)

owasp/owasp_modsecurity_core_rule_set < 3.0.2

Published Sep 03, 2018

Tracked Since Feb 18, 2026