CVE-2012-10047
CRITICALCyclope Employee Surveillance Solution 6.x - SQL Injection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-10047.
PoCs published by Metasploit, loneferret, loneferret, sinn3r, including Metasploit module exploits/windows/http/cyclope_ess_sqli.
AI-analyzed exploit summary This Metasploit module exploits a SQL injection vulnerability in Cyclope Employee Surveillance Solution v6.2 or older, allowing arbitrary code execution under the context of 'SYSTEM' via malicious username parameter manipulation.
Description
Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context.
Exploits (3)
This Metasploit module exploits a SQL injection vulnerability in Cyclope Employee Surveillance Solution v6.2 or older, allowing arbitrary code execution under the context of 'SYSTEM' via malicious username parameter manipulation.
This exploit demonstrates SQL injection leading to remote code execution in Cyclope Employee Surveillance Solution v6.0. It leverages improper input sanitization in the login form's username parameter to write a PHP backdoor, enabling arbitrary command execution.
This Metasploit module exploits a SQL injection vulnerability in Cyclope Employee Surveillance Solution v6.2 or older, allowing arbitrary code execution under the context of 'SYSTEM' by injecting a PHP payload that writes and executes a malicious executable.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X