CVE-2012-1026 - Vulnerability Details - OpenCVE

Multiple SQL injection vulnerabilities in login2.php in XRay CMS 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Johannes Ekberg	Xray Cms

Configuration 1 [-]

cpe:2.3:a:johannes_ekberg:xray_cms:1.1.1:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://archives.neohapsis.com/archives/bugtraq/2012-02/0068.html
http://sourceforge.net/tracker/?func=detail&aid=3488241&group_id=298778&atid=1260461
http://www.exploit-db.com/exploits/18467
http://www.securityfocus.com/bid/51870
https://exchange.xforce.ibmcloud.com/vulnerabilities/73000

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2012-02-08T00:00:00

Updated: 2024-08-06T18:45:27.134Z

Reserved: 2012-02-07T00:00:00

Link: CVE-2012-1026

Vulnrichment

No data.

NVD

Status : Modified

Published: 2012-02-08T00:55:02.627

Modified: 2024-11-21T01:36:13.660

Link: CVE-2012-1026

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-02-06T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in login2.php in XRay CMS 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "51870", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/51870"}, {"name": "20120212 sqlinjection bug in nova cms", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0068.html"}, {"name": "xraycms-login2-sql-injection(73000)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73000"}, {"name": "18467", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/18467"}, {"tags": ["x_refsource_MISC"], "url": "http://sourceforge.net/tracker/?func=detail&aid=3488241&group_id=298778&atid=1260461"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-1026", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple SQL injection vulnerabilities in login2.php in XRay CMS 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "51870", "refsource": "BID", "url": "http://www.securityfocus.com/bid/51870"}, {"name": "20120212 sqlinjection bug in nova cms", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0068.html"}, {"name": "xraycms-login2-sql-injection(73000)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73000"}, {"name": "18467", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/18467"}, {"name": "http://sourceforge.net/tracker/?func=detail&aid=3488241&group_id=298778&atid=1260461", "refsource": "MISC", "url": "http://sourceforge.net/tracker/?func=detail&aid=3488241&group_id=298778&atid=1260461"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T18:45:27.134Z"}, "title": "CVE Program Container", "references": [{"name": "51870", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/51870"}, {"name": "20120212 sqlinjection bug in nova cms", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0068.html"}, {"name": "xraycms-login2-sql-injection(73000)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73000"}, {"name": "18467", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "http://www.exploit-db.com/exploits/18467"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://sourceforge.net/tracker/?func=detail&aid=3488241&group_id=298778&atid=1260461"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-1026", "datePublished": "2012-02-08T00:00:00", "dateReserved": "2012-02-07T00:00:00", "dateUpdated": "2024-08-06T18:45:27.134Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:johannes_ekberg:xray_cms:1.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "723EF9F3-54C6-404F-B357-7E9E7DEAFF81", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in login2.php in XRay CMS 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en login2.php en XRay CMS v1.1.1, permite a atacantes remotos ejecutar comandos SQL a trav\u00e9s de los par\u00e1metros (1) username o (2) password."}], "id": "CVE-2012-1026", "lastModified": "2024-11-21T01:36:13.660", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-02-08T00:55:02.627", "references": [{"source": "cve@mitre.org", "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0068.html"}, {"source": "cve@mitre.org", "url": "http://sourceforge.net/tracker/?func=detail&aid=3488241&group_id=298778&atid=1260461"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/18467"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/51870"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73000"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0068.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://sourceforge.net/tracker/?func=detail&aid=3488241&group_id=298778&atid=1260461"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/18467"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/51870"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73000"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}