CVE-2012-1656
Severity Score
6.8
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
SQL injection vulnerability in the Multisite Search module 6.x-2.2 for Drupal allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the Site table prefix field.
Vulnerabilidad de inyección de comandos SQL en el módulo Multisite Search v6.x-2.2 para Drupal, permite a usuarios autenticados remotaente con algunos permisos, ejecutar comandos SQL a través del prefijo de campo de la tabla Site.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2012-03-12 CVE Reserved
- 2012-09-18 CVE Published
- 2023-04-06 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://drupal.org/node/1471800 | X_refsource_misc | |
| http://www.madirish.net/content/drupal-multisite-search-module-sql-injection-vulnerability | X_refsource_misc | |
| http://www.openwall.com/lists/oss-security/2012/04/07/1 | Mailing List |
|
| http://www.osvdb.org/79857 | Vdb Entry | |
| http://www.securityfocus.com/bid/52342 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/73898 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Wesjones Search vendor "Wesjones" | Multisite Search Search vendor "Wesjones" for product "Multisite Search" | 6.x-2.2 Search vendor "Wesjones" for product "Multisite Search" and version "6.x-2.2" | - |
Affected
| in | Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | - | - |
Safe
|