Microsoft · Sticky Notes · CVE-2012-3998
**Name of the Vulnerable Software and Affected Versions**
Sticky Notes versions prior to 0.2.27052012.5
**Description**
The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters, including the `paste id` in "admin/modules/mod pastes.php" or "show.php", the `user id` to "admin/modules/mod users.php", the `project` to "list.php", or the `session id` to "show.php".
**Recommendations**
For versions prior to 0.2.27052012.5, update to version 0.2.27052012.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints, such as "admin/modules/mod pastes.php", "show.php", "admin/modules/mod users.php", "list.php", to minimize the risk of exploitation. Avoid using the parameters `paste id`, `user id`, `project`, and `session id` in the affected endpoints until the issue is resolved.