PT-2012-2798 · Whmcs · Whmcs

Published 2012-01-14 · Updated 2024-08-06 · CVE-2012-0693

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WHMCS version 5.03

Description The issue allows remote attackers to inject arbitrary code into a subject field via crafted ticket data in the submitticket.php file. Note that the vendor disputes this issue, stating that some details overlap with another vulnerability and that the specified version and file are incorrect.

Recommendations For WHMCS version 5.03, consider restricting access to the submitticket.php file as a temporary workaround until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2012-0693

Affected Products

Whmcs

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-0693 · Security Note
• http://oscommerceuniversity.com/lounge/index.php/topic%2C1209.0.html · Note
• http://oscommerceuniversity.com/lounge/index.php/board%2C23.0.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0693 · Note
• https://t.me/cvenotify/89495 · Telegram Post