CyberSec.Space Logo
Back to CVE Browser

CVE-2018-16384

HIGH
7.5
CVSS Severity Score
EPSS Score0.0010%
EPSS Percentile30.96th
PublishedSep 3, 2018
Last ModifiedNov 21, 2024

Vulnerability Description

A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.

Affected Platforms (CPE)

📦
Owasp

Owasp Modsecurity Core Rule Set

<= 3.0.2
📦
Owasp

Owasp Modsecurity Core Rule Set

= 3.1.0
📦
Owasp

Owasp Modsecurity Core Rule Set

= 3.1.0

References & Advisories

🔗 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1167
🔗 https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
🔗 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1167
🔗 https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html

Related Vulnerabilities

CVE-2021-353689.8

OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypas...

CVE-2019-134647.5

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PH...

CVE-2019-113895.3

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf all...

CVE-2019-113875.3

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf al...