CVEvulnerability
CVE-2008-6992
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-08-19
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.9.4, allows remote attackers to bypass the SQL injection protection mechanism via a WHERE clause containing an expression such as "x=y=z", which is successfully parsed by MySQL.
Affected configurations
• greensql greensql firewall (<= 0.8.3)
• greensql greensql firewall 0.3.4
• greensql greensql firewall 0.3.5
• greensql greensql firewall 0.8.2
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://bugs.mysql.com/bug.php?id=39337 Exploit
- http://osvdb.org/48910 Exploit
- http://sla.ckers.org/forum/read.php?16%2C24367 sla.ckers.org
- http://www.greensql.net/node/89 Patch
- http://www.greensql.net/node/98 Patch
- http://www.greensql.net/security Vendor Advisory
- http://bugs.mysql.com/bug.php?id=39337 Exploit
- http://osvdb.org/48910 Exploit
- http://sla.ckers.org/forum/read.php?16%2C24367 sla.ckers.org
- http://www.greensql.net/node/89 Patch
- http://www.greensql.net/node/98 Patch
- http://www.greensql.net/security Vendor Advisory