Vulnerability Details CVE-2012-4994
SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a browse action. NOTE: some of these details are obtained from third party information.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 59.3%
CVSS Severity
CVSS v2 Score 6.5
References
- http://freecode.com/projects/limesurvey/releases/342070
- http://osvdb.org/79688
- http://secunia.com/advisories/48184
- http://www.limesurvey.org/en/stable-release
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73564
- http://freecode.com/projects/limesurvey/releases/342070
- http://osvdb.org/79688
- http://secunia.com/advisories/48184
- http://www.limesurvey.org/en/stable-release
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73564
Products affected by CVE-2012-4994
-
cpe:2.3:a:limesurvey:limesurvey:1.01
-
cpe:2.3:a:limesurvey:limesurvey:1.45
-
cpe:2.3:a:limesurvey:limesurvey:1.50
-
cpe:2.3:a:limesurvey:limesurvey:1.52
-
cpe:2.3:a:limesurvey:limesurvey:1.53
-
cpe:2.3:a:limesurvey:limesurvey:1.53+
-
cpe:2.3:a:limesurvey:limesurvey:1.70
-
cpe:2.3:a:limesurvey:limesurvey:1.70+
-
cpe:2.3:a:limesurvey:limesurvey:1.71
-
cpe:2.3:a:limesurvey:limesurvey:1.71+
-
cpe:2.3:a:limesurvey:limesurvey:1.72
-
cpe:2.3:a:limesurvey:limesurvey:1.80
-
cpe:2.3:a:limesurvey:limesurvey:1.80+
-
cpe:2.3:a:limesurvey:limesurvey:1.81
-
cpe:2.3:a:limesurvey:limesurvey:1.81+
-
cpe:2.3:a:limesurvey:limesurvey:1.82
-
cpe:2.3:a:limesurvey:limesurvey:1.82+
-
cpe:2.3:a:limesurvey:limesurvey:1.85
-
cpe:2.3:a:limesurvey:limesurvey:1.86
-
cpe:2.3:a:limesurvey:limesurvey:1.87
-
cpe:2.3:a:limesurvey:limesurvey:1.87+
-
cpe:2.3:a:limesurvey:limesurvey:1.90
-
cpe:2.3:a:limesurvey:limesurvey:1.90+
-
cpe:2.3:a:limesurvey:limesurvey:1.91
-
cpe:2.3:a:limesurvey:limesurvey:1.91+