CVE-2012-5849
- State
- Published
- Severity
- Not scored
- Published
- May 14, 2015
- Updated
- Aug 6, 2024
- Reserved
- Nov 8, 2012
Description
Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in an add_friend action to ajax.php; id parameter in a (2) share_object, (3) add_to_fav, (4) rating, or (5) flag_object action to ajax.php; cid parameter in an (6) add_new_item, (7) remove_collection_item, (8) get_item, or (9) load_more_items action to ajax.php; (10) ci_id parameter in a get_item action to ajax.php; user parameter to (11) user_contacts.php or (12) view_channel.php; (13) pid parameter to view_page.php; (14) tid parameter to view_topic.php; or (15) v parameter to watch_video.php.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://forums.clip-bucket.com/showthread.php?12527-Security-Fix-ClipBucket-2-6-SQL-Injections-fix-%28Updated%29
- 23252exploit
- 88175vdb-entry
- http://sourceforge.net/projects/clipbucket/files/ClipBucket%20v2/
- 88177vdb-entry
- 56854vdb-entry
- 88179vdb-entry
- 88180vdb-entry
- 20121207 Multiple SQL Injection vulnerabilities in ClipBucketmailing-list
- 20121205 Multiple SQL Injection vulnerabilities in ClipBucketmailing-list
- 88178vdb-entry
- https://www.htbridge.com/advisory/HTB23125
- 88176vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.