Unscored severity · published Oct 1, 2014
CVE-2012-0811
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Postfix · Postfix
through 2.3.4; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0811
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0811
Exploit
http://www.codseq.it/advisories/multiple_vulnerabilities_in_postfixadmin
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/01/26/5
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/01/27/5
www.securityfocus.com
http://www.securityfocus.com/bid/51680
svn.code.sf.net
https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3/CHANGELOG.TXT
More from Postfix
7.8
CVE-2017-10140
Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in…
7.5
CVE-2026-43964
Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third…
5.3
CVE-2023-51764
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other…
5.3
CVE-2020-12063
A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \xce\xbf…
–
CVE-2011-1720
The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not…