Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-2998 — SQL Injection in Micro Control Manager

CWE-89 — SQL Injection4 documents4 sources
Severity
7.5HIGHNVD
EPSS
9.8%
top 7.03%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Trend Micro Control Manager
Timeline
PublishedSep 28
Latest updateMay 17

Description

SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

Patches

Patch: jvn.jp ↗Patch: jvndb.jvn.jp ↗Patch: www.spentera.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-w5jw-j5vj-mhrq: SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5↗2022-05-17
▶
CVEList
CVE-2012-2998: SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5↗2012-09-28
▶

💥Exploits & PoCs

1
Exploit-DB
Trend Micro Control Manager 5.5/6.0 AdHocQuery - (Authenticated) Blind SQL Injection↗2012-09-27
▶
CVE-2012-2998 — SQL Injection in Trend | cvebase