CVE-2012-0811 - CVE House
Back to Database
Status published Medium CVE-2012-0811

Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before...

Vulnerability Description

Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-0811

Credits & Attribution

No credits recorded in the NVD database.

References

More from postfix

View All →
CVE-2020-12063
A certain Postfix 2.10.1-7 package could allow an attacker to...
Medium 5.3
CVE-2017-10140
Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and...
High 7.8
CVE-2011-1720
The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10,...
Medium 6.8
CVE-2011-0411
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before...
Medium 6.8
CVE-2009-2939
The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix...
Medium 6.9

Affected Vendor

Affected Software

postfix
Vulnerable Versions:
0, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.10, 2.2.11, 2.2.12, 2.3, 2.3.1, 2.3.2, 2.3.3

Timeline

Official Publish: October 1st, 2014
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.