CVE-2012-2171 SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to ex...
MediumCVSS 6.5
EPSS 5.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm ds storage manager host software | <= 10.83 | No fix listed |
| ibm ds storage manager host software | = 10.8 | No fix listed |
| ibm ds storage manager host software | = 10.60.x5.14 | No fix listed |
| ibm ds4100 | All versions | No fix listed |
| ibm ds4100 | = 1724 | No fix listed |
| ibm ds4200 | = 1814 | No fix listed |
| ibm ds4300 | = 1722 | No fix listed |
| ibm ds4400 | = 1742 | No fix listed |
| ibm ds4500 | = 1742 | No fix listed |
| ibm ds4700 | = 1814 | No fix listed |
| ibm ds4800 | = 1815 | No fix listed |
| ibm system storage dcs3700 storage subsystem | = 1818 | No fix listed |
| ibm system storage ds3200 | = 1726 | No fix listed |
| ibm system storage ds3300 | = 1726 | No fix listed |
| ibm system storage ds3400 | = 1726 | No fix listed |
| ibm system storage ds3512 | = 1746 | No fix listed |
| ibm system storage ds3524 | = 1746 | No fix listed |
| ibm system storage ds3950 express | = 1814 | No fix listed |
| ibm system storage ds5020 disk controller | = 1814-20a | No fix listed |
| ibm system storage ds5100 storage controller | = 1818 | No fix listed |
| ibm system storage ds5300 storage controller | = 1818 | No fix listed |
References
- www.ibm.com vendor-advisory
- www.zeroscience.mk
- ssds-smp-sql-injection(75236) vdb-entry