Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-4178

CWE-89 — SQL Injection4 documents4 sources
Severity
7.5HIGH
EPSS
0.8%
top 26.86%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Symantec WEB Gateway
Timeline
PublishedAug 7
Latest updateMay 17

Description

SQL injection vulnerability in spywall/includes/deptUploads_data.php in Symantec Web Gateway 5.0.3.18 allows remote attackers to execute arbitrary SQL commands via the groupid parameter.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDsymantec/web_gateway5.0.3.18

🔴Vulnerability Details

2
GHSA
GHSA-xhr4-2jjv-2g88: SQL injection vulnerability in spywall/includes/deptUploads_data↗2022-05-17
▶
CVEList
CVE-2012-4178: SQL injection vulnerability in spywall/includes/deptUploads_data↗2012-08-07
▶

💥Exploits & PoCs

1
Exploit-DB
Symantec Web Gateway 5.0.3.18 - 'deptUploads_data.php?groupid' Blind SQL Injection↗2012-07-30
▶
CVE-2012-4178 (HIGH CVSS 7.5) | SQL injection vulnerability in spyw | cvebase.io