Description
login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sql-ledger | 2.6.21-1 | — |
| Debian 13 | sql-ledger | 2.6.21-1 | — |
| Debian 12 | sql-ledger | 2.6.21-1 | — |
| Debian 3.1 | sql-ledger | 2.4.7-2sarge1 | DSA-1239-1 |
Advisories 1
- DSA-1239-1 sql-ledger Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1017391 vdb-entry
- 21634 vdb-entry
- 23375 third-party-advisory
- 23419 third-party-advisory
- ADV-2006-5043 vdb-entry
- DSA-1239 vendor-advisory
- ADV-2007-0407 vdb-entry
- 20070127 Full Disclosure: Arbitrary Code Execution in LedgerSMB CVE-2006-5872 mailing-list