CVE-2012-4601

Loading...

General

Score:6.0/10.0
Severity:Medium
Category:SQL Injection

Impact Metrics

Confidentiality:Partial
Integrity:Partial
Availability:Partial

Exploitability Metrics

Access Vector:Network
Access Complexity:Medium
Authentication:Single

Published on 23/11/12 - Updated on 26/11/12

Description

Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the (1) user_groups[] parameter to admin/code/tce_edit_test.php or (2) subject_id parameter to admin/code/tce_show_all_questions.php.

Category: SQL Injection

CWE-89 (SQL Injection)
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Security Notices

US National Vulnerability DatabaseCVE-2012-4601

Exploits

No exploits available for this CVE in our database.

Relative technologies

VendorProduct
tecnicktcexam

Share this vulnerability with:

Twitter Facebook LinkedIn Mail