CVE-2018-4056 SQL injection in coTURN
SQL injection in coTURN admin portal allows authentication bypass and unauthorized access to the administrator interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-4056?
CVE-2018-4056 is a critical SQL injection vulnerability in Debian Debian Linux, published on 5 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.
Weakness: CWE-89
Which versions are affected by CVE-2018-4056?
It affects 2 products.
Products include Coturn Project Coturn, Debian Debian Linux.
How do I fix CVE-2018-4056?
Upgrade to a fixed version.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2018-4056 being exploited?
There is no known exploitation of CVE-2018-4056 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2026-43994 Coturn: Stack buffer overflow in decode_oauth_token_gcm()
- CVE-2018-4058 Server-side request forgery in coTURN
- CVE-2026-40613 Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)
- CVE-2026-53450 Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
- CVE-2026-53448 Coturn: SQL Injection in HTTPS Admin Panel Delete Operations
Sources
Also known as DEBIAN-CVE-2018-4056, GHSA-c3pf-948r-8592, UBUNTU-CVE-2018-4056.