Description
SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sql-ledger | 2.6.18-1 | — |
| Debian 13 | sql-ledger | 2.6.18-1 | — |
| Debian 12 | sql-ledger | 2.6.18-1 | — |
| Debian 3.1 | sql-ledger | 2.4.7-2sarge1 | DSA-1239-1 |
Advisories 1
- DSA-1239-1 sql-ledger Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.sql-ledger.org/cgi-bin/nav.pl?page=news.html&title=What%27s%20New
- sql-ledger-session-unauth-access(28671) vdb-entry
- 19758 vdb-entry
- 21689 third-party-advisory
- 20060830 SQL-Ledger serious security vulnerability and workaround mailing-list
- 20060907 Full Disclosure for SQL-Ledger vulnerability CVE-2006-4244 mailing-list
- 1472 third-party-advisory