Unscored severity · published Feb 19, 2003
CVE-2003-0040
SQL injection vulnerability in the PostgreSQL auth module for courier 0.40 and earlier allows remote attackers to execute SQL code via the user name
–
CVSS
1.2%
EPSS
No
On KEV
Description
SQL injection vulnerability in the PostgreSQL auth module for courier 0.40 and earlier allows remote attackers to execute SQL code via the user name.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Courier Mta · Double Precision Incorporated
0.37.3 · source: NVD
CO
Courier-imap · Inter7
1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-0040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-0040
Patch
http://www.debian.org/security/2003/dsa-247
Patch
http://www.securityfocus.com/bid/6738
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/11213
More from Courier Mta
–
CVE-2006-2659
libs/comverp.c in Courier MTA before 0.53.2 allows attackers to cause a denial of service (CPU consumption) via unknown vectors involving usernames that contain the "=" (equals)…
–
CVE-2004-0224
Multiple buffer overflows in (1) iso2022jp.c or (2) shiftjis.c for Courier-IMAP before 3.0.0, Courier before 0.45, and SqWebMail before 4.0.0 may allow remote attackers to execute…
–
CVE-2002-1311
Courier sqwebmail before 0.40.0 does not quickly drop privileges after startup in certain cases, which could allow local users to read arbitrary files
–
CVE-2002-0914
Double Precision Courier e-mail MTA allows remote attackers to cause a denial of service (CPU consumption) via a message with an extremely large or negative value for the year,…