CVE-2024-53678

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. The data returned by the SELECT statement is not viewable by the attacker.

This issue affects all versions of Apache VCL from 2.2 through 2.5.1.

Users are recommended to upgrade to version 2.5.2, which fixes the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache VCL	>= 2.2, <= 2.5.1

References

https://lists.apache.org/thread/2bmjnzgjwwq59nv6xw44w0tnpz4k4pf4Issue Tracking, Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/03/24/1Mailing List, Third Party Advisory

Timeline

Published: Mar 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-536795.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A CVE-2024-53686.1A vulnerability was found in Kashipara College Management System 1.0. It has been classified as problematic. Affected is an unknown function CVE-2024-536805.5In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()CVE-2024-536815.5In the Linux kernel, the following vulnerability has been resolved: nvmet: Don't overflow subsysnqn nvmet_root_discovery_nqn_store treats CVE-2024-536825.5In the Linux kernel, the following vulnerability has been resolved: regulator: axp20x: AXP717: set ramp_delay AXP717 datasheet says that r CVE-2024-536834.4A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA. An attacker could use CVE-2024-536848.8A cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially cr CVE-2024-536855.5In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX If the full path to be bui CVE-2024-536875.5In the Linux kernel, the following vulnerability has been resolved: riscv: Fix IPIs usage in kfence_protect_page() flush_tlb_kernel_range(CVE-2024-536887.2Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in AE1021 firmware versions 2.0.10 a CVE-2024-53696.1A vulnerability was found in Kashipara College Management System 1.0. It has been declared as problematic. Affected by this vulnerability is CVE-2024-536905.5In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent use of deleted inode syzbot reported a WARNING in nilf