CVE-2011-4959

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in the addslashes method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6, when connected to a MySQL database using far east character encodings, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12Vendor Advisory
http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/04/30/1
http://www.openwall.com/lists/oss-security/2012/04/30/3
https://github.com/silverstripe/sapphire/commit/73cca09Exploit, Patch
https://github.com/silverstripe/sapphire/commit/ca78784Exploit, Patch
https://github.com/silverstripe/silverstripe-cms/commit/b5ea2f6Exploit, Patch
http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12Vendor Advisory
http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/04/30/1
http://www.openwall.com/lists/oss-security/2012/04/30/3
https://github.com/silverstripe/sapphire/commit/73cca09Exploit, Patch
https://github.com/silverstripe/sapphire/commit/ca78784Exploit, Patch
https://github.com/silverstripe/silverstripe-cms/commit/b5ea2f6Exploit, Patch

Timeline

Published: Sep 17, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-49607.5SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attack CVE-2011-49616.0SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain admin CVE-2011-49626.8code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a c CVE-2011-49635.0nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted CVE-2011-49666.0modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the passw CVE-2011-49677.5tog-Pegasus has a package hash collision DoS vulnerability CVE-2011-49684.8nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)CVE-2011-49694.3Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inj CVE-2011-49707.5Multiple SQL injection vulnerabilities in LCG Disk Pool Manager (DPM) before 1.8.6, as used in EGI UDM, allow remote attackers to execute ar CVE-2011-49715.0Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) pro CVE-2011-49727.5hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attacke CVE-2011-49739.8Authentication bypass vulnerability in mod_nss 1.0.8 allows remote attackers to assume the identity of a valid user by using their certifica