What is CVE-2012-0811?

CVE-2012-0811 is a vulnerability in Postfix, classified under SQL Injection. Published 2014-10-01.

Is CVE-2012-0811 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Postfix

CVE-2012-0811

Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.

Vulnerability class: SQL Injection

EPSS: 0.017 (74.6th percentile) — read the EPSS interpretation.

Affected products

Postfix — versions 2.0.0, 2.0.1, 2.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

fir3storm/Vision2

References

secalert@redhat.com (vdb-entry, x_refsource_BID)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (Exploit, x_refsource_MISC)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2012-0811?: CVE-2012-0811 is a vulnerability in Postfix, classified under SQL Injection. Published 2014-10-01.
Is CVE-2012-0811 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.