CVE-2012-4237
published 2012-08-20CVE-2012-4237: Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL…
PriorityP338medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
2.39%
81.9th percentile
Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the subject_module_id parameter to (1) tce_edit_answer.php or (2) tce_edit_question.php.
Affected
101 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tecnick | tcexam | <= 11.3.007 | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
| tecnick | tcexam | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
TCExam 11.2.x - '/admin/code/tce_edit_answer.php' Multiple SQL Injections
exploitdb·2012-08-07
CVE-2012-4237 TCExam 11.2.x - '/admin/code/tce_edit_answer.php' Multiple SQL Injections
TCExam 11.2.x - '/admin/code/tce_edit_answer.php' Multiple SQL Injections
---
source: https://www.securityfocus.com/bid/54861/info
TCExam is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Versions prior to TCExam 11.3.008 are vulnerable.
http://www.example.com/admin/code/tce_edit_answer.php?subject_module_id
http://www.example.com/admin/code/tce_edit_answer.php?question_subject_id
Exploit-DB
TCExam 11.2.x - '/admin/code/tce_edit_question.php?subject_module_id' SQL Injection
exploitdb·2012-08-07
CVE-2012-4237 TCExam 11.2.x - '/admin/code/tce_edit_question.php?subject_module_id' SQL Injection
TCExam 11.2.x - '/admin/code/tce_edit_question.php?subject_module_id' SQL Injection
---
source: https://www.securityfocus.com/bid/54861/info
TCExam is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Versions prior to TCExam 11.3.008 are vulnerable.
http://www.example.com/admin/code/tce_edit_question.php?subject_module_id
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2012-08/0079.htmlhttp://freecode.com/projects/tcexam/releases/347125http://secunia.com/advisories/50141http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Bh=edf6e08622642f1b2421f4355d98250d9e1b0742http://www.openwall.com/lists/oss-security/2012/08/13/8http://www.reactionpenetrationtesting.co.uk/tcexam-sql-injection.htmlhttp://www.securityfocus.com/bid/54861http://archives.neohapsis.com/archives/bugtraq/2012-08/0079.htmlhttp://freecode.com/projects/tcexam/releases/347125http://secunia.com/advisories/50141http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Bh=edf6e08622642f1b2421f4355d98250d9e1b0742http://www.openwall.com/lists/oss-security/2012/08/13/8http://www.reactionpenetrationtesting.co.uk/tcexam-sql-injection.htmlhttp://www.securityfocus.com/bid/54861
2012-08-20
Published