← back
CVE-2012-4528

CVE-2012-4528

EPSS 12.5%
The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
Affected products
n/a · n/a
public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/37949unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093011.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00020.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00025.htmlhttp://lists.opensuse.org/opensuse-updates/2013-08/msg00031.htmlhttp://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGEShttp://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?sortby=date&r1=2081&r2=2080&pathrev=2081http://mod-security.svn.sourceforge.net/viewvc/mod-security?view=revision&sortby=date&revision=2081http://seclists.org/fulldisclosure/2012/Oct/113https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20121017-0_mod_security_ruleset_bypass.txthttp://www.openwall.com/lists/oss-security/2012/10/18/14