CVE-2012-0693: Code Injection

Published Jan 14, 2012

Updated

DISPUTED submitticket.php in WHMCompleteSolution (WHMCS) 5.03 allows remote attackers to inject arbitrary code into a subject field via crafted ticket data, a different vulnerability than CVE-2011-5061. NOTE: the vendor disputes this issue, noting that some of the details overlap CVE-2011-5061, but that it "says it affects V5.0.3, and the submitticket.php file, both of which are wrong."

Affected Software

1 affected component

WHMCS WHMCompleteSolution=5.03

Event History

Jan 14, 2012

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Disputed

03:57 AM

Frequently Asked Questions

What is the severity of CVE-2012-0693?

CVE-2012-0693 is considered a medium severity vulnerability as it allows remote code injection via the ticket submission process.

How do I fix CVE-2012-0693?

To remediate CVE-2012-0693, please upgrade WHMCS to a later version that addresses this vulnerability.

What type of attack is associated with CVE-2012-0693?

CVE-2012-0693 is associated with remote code injection attacks through manipulated ticket data.

Which version of WHMCS is affected by CVE-2012-0693?

CVE-2012-0693 affects WHMCS version 5.03.

Is there any vendor response related to CVE-2012-0693?

Yes, the vendor disputes the severity and details of CVE-2012-0693, noting overlaps with CVE-2011-5061.