CVE-2012-10047 Cyclope Employee Surveillance Solution v6.x SQL Injection
CriticalCVSS 10.0
EPSS 1.5%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Cyclope-Series Cyclope Employee Surveillance Solution | = 6.0 | No fix listed |
References
- raw.githubusercontent.com exploit
- www.exploit-db.com exploit
- www.exploit-db.com exploit
- www.cyclope-series.com product
- www.vulncheck.com third-party-advisory