PT-2023-9990 · Arc2 · Arc2

Beinux3 + 3 · Published 2023-04-25 · Updated 2025-02-03 · CVE-2012-5872

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ARC (aka ARC2) through 2011-12-01

Description The issue allows blind SQL Injection in the getTriplePatternSQL function within ARC2 StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.

Recommendations For ARC (aka ARC2) through 2011-12-01, consider disabling the getTriplePatternSQL function in ARC2 StoreSelectQueryHandler.php to prevent exploitation until a fix is available. Restrict access to comments in SPARQL WHERE clauses to minimize the risk of blind SQL Injection.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2012-5872

Affected Products

Arc2

References · 5

• 🔥 https://ush.it/2012/11/22/arc-v2011-12-01-multiple-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5872 · Security Note
• https://t.me/cvenotify/109763 · Telegram Post
• https://t.me/cibsecurity/62881 · Telegram Post
• https://t.me/cvenotify/49082 · Telegram Post