CVE-2012-2105 Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| peter kovacs timesheet next gen | = 1.5.2 | No fix listed |
References
- 20120302 Timesheet Next Gen 1.5.2 Multiple SQLi exploit mailing-list
- 48239 third-party-advisory vendor-advisory
- sourceforge.net
- 18554 exploit
- [oss-security] 20120416 CVE-request: Timesheet Next Gen 1.5.2 Multiple SQLi mailing-list
- [oss-security] 20120416 Re: CVE-request: Timesheet Next Gen 1.5.2 Multiple SQLi mailing-list
- 79804 vdb-entry
- 52270 exploit vdb-entry
- timesheetnextgen-login-sql-injection(73680) vdb-entry