PT-2023-9990 · Arc2 · Arc2

Beinux3 + 3 · Publicado 2023-04-25 · Atualizado 2025-02-03 · CVE-2012-5872

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ARC (aka ARC2) through 2011-12-01

Description The issue allows blind SQL Injection in the getTriplePatternSQL function within ARC2 StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.

Recommendations For ARC (aka ARC2) through 2011-12-01, consider disabling the getTriplePatternSQL function in ARC2 StoreSelectQueryHandler.php to prevent exploitation until a fix is available. Restrict access to comments in SPARQL WHERE clauses to minimize the risk of blind SQL Injection.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2012-5872

Produtos afetados

Arc2

Referências · 5

• 🔥 https://ush.it/2012/11/22/arc-v2011-12-01-multiple-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5872 · Nota de Segurança
• https://t.me/cvenotify/109763 · Publicação no Telegram
• https://t.me/cibsecurity/62881 · Publicação no Telegram
• https://t.me/cvenotify/49082 · Publicação no Telegram