CVE-2012-5290 Multiple SQL injection vulnerabilities in EasyWebRealEstate allow remote attackers to execute arbitrary SQL commands via the (1) lstid parameter to listings.php or (2) infoid parameter to index.php.
HighCVSS 7.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in EasyWebRealEstate allow remote attackers to execute arbitrary SQL commands via the (1) lstid parameter to listings.php or (2) infoid parameter to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wcs4web easywebrealestate | All versions | No fix listed |
References
- packetstormsecurity.org exploit
- easyweb-listings-index-sql-injection(72148) vdb-entry