CVE-2014-2323

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote...

9.8 CriticalPublic exploitFix available

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

62.8%Up 35.4 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Record: CVE-2014-2323
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Record: CVE-2014-2323
Updated: 2026-11-02

EUVDEUVD-2014-2360 No score

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Record: EUVD-2014-2360
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v97w-2rqc-4p78 9.8

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote...

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Record: GHSA-v97w-2rqc-4p78
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSV 9.8

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Record: CVE-2014-2323
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-2323 9.8

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Record: DEBIAN-CVE-2014-2323
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-2323 9.8

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Record: UBUNTU-CVE-2014-2323
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2014-0133 No score

Updated lighttpd package fixes security vulnerabilities

SQL injection vulnerability in lighttpd before 1.4.35 when mod_mysql_vhost is in use, due to insufficient validation of hostnames in HTTP requests (CVE-2014-2323).

Possible path traversal vulnerabilities in lighttpd before 1.4.35 when either mod_evhost or mod_simple_vhost are in use, due to insufficient validation of hostnames in HTTP requests (CVE-2014-2324).

Record: MGASA-2014-0133
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10402-1 No score

lighttpd-1.4.37-1.6 on GA media

These are all security issues fixed in the lighttpd-1.4.37-1.6 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10402-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`lighttpd` Debian:12	before 1.4.33-1+nmu3	1.4.33-1+nmu3
`lighttpd` Debian:13	before 1.4.33-1+nmu3	1.4.33-1+nmu3
`lighttpd` Debian:14	before 1.4.33-1+nmu3	1.4.33-1+nmu3
`lighttpd` Debian:6.0	before 1.4.28-2+squeeze1.6, plus listed versions 1.4.28-21.4.28-2+squeeze11.4.28-2+squeeze1.11.4.28-2+squeeze1.21.4.28-2+squeeze1.31.4.28-2+squeeze1.41.4.28-2+squeeze1.5	1.4.28-2+squeeze1.6
`lighttpd` Debian:7	before 1.4.31-4+deb7u3, plus listed versions 1.4.31-41.4.31-4+deb7u11.4.31-4+deb7u2	1.4.31-4+deb7u3
`lighttpd` Mageia:3	before 1.4.32-3.7.mga3	1.4.32-3.7.mga3
`lighttpd` Mageia:4	before 1.4.33-4.1.mga4	1.4.33-4.1.mga4
`lighttpd` Ubuntu:14.04:LTS	before 1.4.33-1+nmu2ubuntu2.1, plus listed versions 1.4.31-3ubuntu31.4.33-1ubuntu11.4.33-1+nmu2ubuntu11.4.33-1+nmu2ubuntu2	1.4.33-1+nmu2ubuntu2.1
`lighttpd` openSUSE:Tumbleweed	before 1.4.37-1.6	1.4.37-1.6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	Lighttpd 1.4.34 SQL Injection and Path Traversal
PoC in GitHub	cirocosta/lighty-sqlinj-demo	2015-10-08

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-2323 is a critical vulnerability (CVSS 9.8) in Lighttpd, published March 12, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 62.8%, the 99th percentile. Fixed in lighttpd 1.4.33-1+nmu3.

References

Show 22 moreShow less