[Forgot Password]
Login  Register Subscribe

24128

 
 

131615

 
 

114411

 
 

909

 
 

88812

 
 

136

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2012-1557Date: (C)2012-03-12   (M)2018-02-19


SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in March 2012.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 7.5
Exploit Score: 10.0
Impact Score: 6.4
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL
  
Reference:
SECTRACK-1026760
SECUNIA-48262
BID-52267
OSVDB-79769
http://www.openwall.com/lists/oss-security/2012/03/08/3
http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-linux-updates-release-notes.html#10216
http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-windows-updates-release-notes.html#10216
http://kb.parallels.com/en/113321
http://www.cert.fi/haavoittuvuudet/2012/haavoittuvuus-2012-035.html
http://www.h-online.com/security/news/item/Bug-in-Plesk-administration-software-is-being-actively-exploited-1446587.html
plesk-unspec-unauth-access(73628)

CPE    13
cpe:/a:parallels:parallels_plesk_panel:8.6
cpe:/a:parallels:parallels_plesk_panel:9.5
cpe:/a:parallels:parallels_plesk_panel:8.1
cpe:/a:parallels:parallels_plesk_panel:9.0
...
CWE    1
CWE-89

© SecPod Technologies