CVE-2002-2043

SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2002-12-31

Last modified

2024-09-17

Affected products

• Sasl (Cyrus)

References

• http://archives.neohapsis.com/archives/bugtraq/2002-04/0020.html
• http://www.iss.net/security_center/static/8748.php
• http://www.securityfocus.com/bid/4409