CVE-2014-2323

Critical

Published: 14/03/2014(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Risk Assessment

Attackers can exploit this vulnerability to gain unauthorized access to the database, potentially leading to data disclosure or modification.

Recommendation

It is recommended to upgrade lighttpd to version 1.4.35 or later to mitigate this vulnerability.

Original NVD description (English source)

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.