CVE-2012-5849: SQL Injection
Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in an addfriend action to ajax.php; id parameter in a (2) shareobject, (3) addtofav, (4) rating, or (5) flagobject action to ajax.php; cid parameter in an (6) addnewitem, (7) removecollectionitem, (8) getitem, or (9) loadmoreitems action to ajax.php; (10) ciid parameter in a getitem action to ajax.php; user parameter to (11) usercontacts.php or (12) viewchannel.php; (13) pid parameter to viewpage.php; (14) tid parameter to viewtopic.php; or (15) v parameter to watchvideo.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5849?
CVE-2012-5849 is considered a high severity vulnerability due to its potential for remote SQL command execution.
How do I fix CVE-2012-5849?
To fix CVE-2012-5849, upgrade ClipBucket to version 2.6 Revision 739 or later.
What types of SQL injection are present in CVE-2012-5849?
CVE-2012-5849 includes multiple SQL injection vulnerabilities via specific parameters in various AJAX actions.
Can CVE-2012-5849 affect my website?
Yes, if you are using ClipBucket version 2.6 or earlier, your website may be vulnerable to CVE-2012-5849.
Who can exploit CVE-2012-5849?
Remote attackers with knowledge of the vulnerable parameters can exploit CVE-2012-5849 to execute arbitrary SQL commands.