Fluid Attacks Database

Description

phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and password in the login panel.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version
debian 14	phpldapadmin	=1.2.6.7-4
debian 13	phpldapadmin	=1.2.6.7-4
debian 12	phpldapadmin	=1.2.6.3-0.3 \|\| =1.2.6.3-0.3+deb12u1 \|\| =1.2.6.6-1 \|\| =1.2.6.6-2 \|\| =1.2.6.7-1 \|\| =1.2.6.7-2 \|\| =1.2.6.7-2~bpo12+1 \|\| =1.2.6.7-3 \|\| =1.2.6.7-3~bpo12+1 \|\| =1.2.6.7-4

Aliases

1. CVE-2018-126892. NVD-2018-126893. OSV-DEBIAN-2018-126894. OSV-2018-126895. SECURITY-TRACKER-CVE-2018-12689

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.