CVE-2012-5872 ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.
CriticalCVSS 9.8
EPSS 0.75%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arc2 project arc2 | <= 2011-12-01 | No fix listed |
References
- www.ush.it exploit third-party-advisory