CVE-2012-0973
high
CVSS v3
—
CVSS v2
7.5
VIR risk
7.5
Description
Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php and (2) findBySlug function oc-includes/osclass/model/Category.php. NOTE: some of these details are obtained from third party information.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — http://secunia.com/advisories/47697
Vendor advisory: cve@mitre.org — http://osclass.org/2012/01/16/osclass-2-3-5/
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| osclass | osclass | {"endIncluding":"2.3.4"} | |
References
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0157.html
- http://osclass.org/2012/01/16/osclass-2-3-5/
- http://secunia.com/advisories/47697
- http://www.securityfocus.com/bid/51662
- https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-73
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_osclass.html
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0157.html
- http://osclass.org/2012/01/16/osclass-2-3-5/
- http://secunia.com/advisories/47697
- http://www.securityfocus.com/bid/51662
- https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-73
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_osclass.html
CWEs
CWE-89
Verify integrity in audit chain (admin only). AS-IS.