PT-2012-5685 · Verifone · Vericentre Web Console

Cory Eubanks · Published 2012-11-15 · Updated 2017-08-29 · CVE-2012-4951

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VeriFone VeriCentre Web Console versions prior to 2.2 build 36

Description The issue concerns SQL injection vulnerabilities in the terminal/paramedit.aspx file. Remote attackers can execute arbitrary SQL commands by manipulating the TerminalId, ModelName, or ApplicationName parameters.

Recommendations For versions prior to 2.2 build 36, update to version 2.2 build 36 or later to resolve the issue. As a temporary workaround, consider restricting access to the terminal/paramedit.aspx file to minimize the risk of exploitation. Avoid using the TerminalId, ModelName, or ApplicationName parameters in the affected file until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-4951

Affected Products

Vericentre Web Console

References · 6

• 🔥 http://clearskies.net/documents/css-advisory-css1211-vericentre.pdf · Exploit
• 🔥 https://exploit-db.com/exploits/38010 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4951 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79832 · Note
• http://kb.cert.org/vuls/id/180091 · Note
• http://securityfocus.com/bid/56409 · Note