CVE-2011-5266 Details
Description
Imperva SecureSphere Web Application Firewall (WAF) before 12-august-2010 allows SQL injection filter bypass.
A SQL injection filter bypass vulnerability has been identified in Imperva SecureSphere Web Application Firewall (WAF) versions prior to August 12, 2010. This vulnerability allows attackers to evade SQL injection protections by exploiting a typo in the WAF's SQL injection detection rules. The bypass is achieved by appending a crafted string that manipulates the WAF's filtering mechanism, enabling potentially malicious SQL injection payloads to be processed without detection.
Users are advised to apply the ADC Content Update from August 12, 2010.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://seclists.org/fulldisclosure/2011/May/163 | CVE | ExploitMailing ListThird Party Advisory |
| http://seclists.org/fulldisclosure/2011/May/163 | [email protected] | ExploitMailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| imperva securesphere web application firewall | < 2010-08-12 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 16, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Jan 15, 2020 | Initial Analysis | [email protected] |