Vulnerabilities > CVE-2012-1002 - SQL Injection vulnerability in OpenConf 'edit.php'
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary SQL commands via the pid parameter.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 5 |
D2sec
| name | OpenConf SQL Injection |
| url | http://www.d2sec.com/exploits/openconf_sql_injection.html |
Exploit-Db
| description | OpenConf <= 4.11 (author/edit.php) Remote Blind SQL Injection Exploit. CVE-2012-1002. Webapps exploit for php platform |
| file | exploits/php/webapps/18820.php |
| id | EDB-ID:18820 |
| last seen | 2016-02-02 |
| modified | 2012-05-02 |
| platform | php |
| port | |
| published | 2012-05-02 |
| reporter | EgiX |
| source | https://www.exploit-db.com/download/18820/ |
| title | OpenConf <= 4.11 author/edit.php Remote Blind SQL Injection Exploit |
| type | webapps |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/112402/openconf-sql.txt |
| id | PACKETSTORM:112402 |
| last seen | 2016-12-05 |
| published | 2012-05-02 |
| reporter | EgiX |
| source | https://packetstormsecurity.com/files/112402/OpenConf-4.11-Blind-SQL-Injection.html |
| title | OpenConf 4.11 Blind SQL Injection |
Seebug
| bulletinFamily | exploit |
| description | No description provided by source. |
| id | SSV:72849 |
| last seen | 2017-11-19 |
| modified | 2014-07-01 |
| published | 2014-07-01 |
| reporter | Root |
| source | https://www.seebug.org/vuldb/ssvid-72849 |
| title | OpenConf <= 4.11 (author/edit.php) Remote Blind SQL Injection Exploit |