Unscored severity · published Aug 1, 2011
CVE-2011-2703
Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors…
–
CVSS
2.7%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mapserver · Osgeo
through 4.10.6; 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2703
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2703
Patch
http://lists.osgeo.org/pipermail/mapserver-users/2011-July/069430.html
Vendor Advisory
http://secunia.com/advisories/45257
Vendor Advisory
http://secunia.com/advisories/45318
Vendor Advisory
http://secunia.com/advisories/45368
Patch
http://trac.osgeo.org/mapserver/ticket/3903
www.debian.org
http://www.debian.org/security/2011/dsa-2285
More from Mapserver
9.8
CVE-2025-59431
MapServer is a system for developing web-based GIS applications
9.8
CVE-2017-5522
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash)…
7.5
CVE-2026-45104
MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`
7.5
CVE-2026-33721
MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing
7.5
CVE-2010-1678
Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing