CVE-2014-2323 PoC — lighttpd SQL注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2323.yaml

Associated Vulnerability

Title:lighttpd SQL注入漏洞 (CVE-2014-2323)
Description:lighttpd是德国软件开发者Jan Kneschke所研发的一款开源的Web服务器，它的主要特点是仅需少量的内存及CPU资源即可达到同类网页服务器的性能。 lighttpd 1.4.34及之前版本中的mod_mysql_vhost.c文件存在SQL注入漏洞。远程攻击者可借助特制的主机名利用该漏洞执行任意SQL命令。

Description

A SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name (related to request_check_hostname).

File Snapshot


 id: CVE-2014-2323

info:
  name: Lighttpd 1.4.34 SQL Injection and Path Traversal
  author: geeknik


...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!