CVE-2012-4673

State: Published
Severity: Not scored
Published: Aug 26, 2012
Updated: Sep 16, 2024
Reserved: Aug 25, 2012

Description

SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL commands via vectors involving the sort_col variable in the list_items function, a different vulnerability than CVE-2012-3477.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/mweimerskirch/neoinvoice/commit/501a9d5d261c718913cfc13d212b09b56f3bf087
http://adamcaudill.com/2012/08/12/neoinvoice-blind-sql-injection-cve-2012-3477/
https://github.com/tlhunter/neoinvoice/issues/2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.