CVE-2016-8640
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2016-8640
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
pycsw SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pycsw是一个开源的、跨平台的使用Python编写的OGC CSW服务器的实现，它支持通过众多API发布和发现地理空间元数据并提供了基于标准的元数据和空间数据基础设施的目录组件。 pycsw 2.0.2之前的版本、1.10.5之前的版本和1.8.6之前的版本中存在SQL注入漏洞。攻击者可利用该漏洞从pycsw数据库的任意表单中读取和提取任意数据，更新/插入/删除/修改任意表单。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| https://github.com/geopython | pycsw | all versions before 2.0.2, 1.10.5 and 1.8.6 | - |
II. Public POCs for CVE-2016-8640
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-8640
请登录查看更多情报信息。
- https://patch-diff.githubusercontent.com/raw/geopython/pycsw/pull/474.patchx_refsource_CONFIRM
- https://github.com/geopython/pycsw/pull/474/filesx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2016-8640
IV. Related Vulnerabilities
Same weakness: CWE-89
- CVE-2021-47941
WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss - CVE-2021-47930
Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthentic - CVE-2021-47928
Opencart TMD Vendor System 3.x Blind SQL Injection via produ - CVE-2026-8231
CodeAstro Online Catering Ordering System deleteorder.php sq - CVE-2025-14179
SQL injection in pdo_firebird via NUL bytes in quoted string
V. Comments for CVE-2016-8640
No comments yet