CVE-2012-5162: SQL Injection

Q: Who can exploit this issue?

A remote attacker must authenticate to OSClass, as indicated by the vulnerability vector's single-authentication requirement (Au:S). No additional access prerequisites are provided.

Q: Which requests are affected?

The affected endpoint is oc-admin/ajax/ajax.php. The vulnerable id parameter is used with the edit_category_post and enable_category actions sent to index.php.

Q: Which OSClass versions need remediation?

OSClass versions before 2.3.5 are affected. Upgrade to version 2.3.5 or later.

Published Sep 26, 2012

Updated

Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) editcategorypost or (2) enablecategory action to index.php.

Affected Software

1 affected component

OSClass Osclass<=2.3.4

Event History

Sep 26, 2012

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must authenticate to OSClass, as indicated by the vulnerability vector's single-authentication requirement (Au:S). No additional access prerequisites are provided.

Which requests are affected?

The affected endpoint is oc-admin/ajax/ajax.php. The vulnerable id parameter is used with the edit_category_post and enable_category actions sent to index.php.

Which OSClass versions need remediation?

OSClass versions before 2.3.5 are affected. Upgrade to version 2.3.5 or later.

CVE-2012-5162: SQL Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which requests are affected?

Which OSClass versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which requests are affected?

Which OSClass versions need remediation?