PT-2013-1984 · Wikidforum · Wikidforum

Henri Salo · Published 2013-01-24 · Updated 2017-08-29 · CVE-2012-6520

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wikidforum version 2.10

Description The issue concerns SQL injection vulnerabilities in the advanced search functionality. Remote attackers can execute arbitrary SQL commands by manipulating the select sort or opt search select parameters.

Recommendations For Wikidforum version 2.10, as a temporary workaround, consider restricting access to the advanced search functionality until a patch is available. Avoid using the select sort and opt search select parameters in the affected search endpoint until the issue is resolved.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-6520

Affected Products

Wikidforum

References · 10

• 🔥 http://securityfocus.com/bid/52425 · Exploit
• 🔥 https://exploit-db.com/exploits/36946 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-03/0046.html · Exploit
• 🔥 http://darksecurity.de/advisories/2012/SSCHADV2012-005.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-6520 · Security Note
• http://openwall.com/lists/oss-security/2012/04/15/1 · Note
• http://openwall.com/lists/oss-security/2012/04/13/4 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73980 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6520 · Note
• http://openwall.com/lists/oss-security/2012/04/12/12 · Note