vendor:
phpLDAPadmin
by:
Berk Dusunur
7.5
CVSS
HIGH
LDAP Injection
90
CWE
Product Name: phpLDAPadmin
Affected Version From: 1.2.2
Affected Version To: 1.2.2
Patch Exists: NO
Related CWE: N/A
CPE: a:phpldapadmin:phpldapadmin:1.2.2
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Pardus / Debian Web Server
2018
phpLDAPadmin 1.2.2 – ‘server_id’ LDAP Injection (Username)
phpLDAPadmin 1.2.2 is vulnerable to LDAP injection in the 'server_id' parameter. An attacker can inject malicious LDAP statements into the 'server_id' parameter and execute arbitrary commands on the server. This can be exploited to gain access to the application and the underlying system.
Mitigation:
Input validation should be used to prevent LDAP injection attacks. All user-supplied input should be validated and filtered before being used in an LDAP query.
