PT-2012-5685 · Verifone · Vericentre Web Console

Cory Eubanks · Publicado 2012-11-15 · Atualizado 2017-08-29 · CVE-2012-4951

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VeriFone VeriCentre Web Console versions prior to 2.2 build 36

Description The issue concerns SQL injection vulnerabilities in the terminal/paramedit.aspx file. Remote attackers can execute arbitrary SQL commands by manipulating the TerminalId, ModelName, or ApplicationName parameters.

Recommendations For versions prior to 2.2 build 36, update to version 2.2 build 36 or later to resolve the issue. As a temporary workaround, consider restricting access to the terminal/paramedit.aspx file to minimize the risk of exploitation. Avoid using the TerminalId, ModelName, or ApplicationName parameters in the affected file until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-4951

Produtos afetados

Vericentre Web Console

Referências · 6

• 🔥 http://clearskies.net/documents/css-advisory-css1211-vericentre.pdf · Exploit
• 🔥 https://exploit-db.com/exploits/38010 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79832 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4951 · Nota de Segurança
• http://kb.cert.org/vuls/id/180091 · Nota
• http://securityfocus.com/bid/56409 · Nota