CVE-2012-1259

CRITICAL

Plixer Scrutinizer Netflow & Sflow Analyzer - SQL Injection

Title source: rule

Description

Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the (1) addip parameter to cgi-bin/scrut_fa_exclusions.cgi, (2) getPermissionsAndPreferences parameter to cgi-bin/login.cgi, or (3) possibly certain parameters to d4d/alarms.php as demonstrated by the search_str parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Trustwave's SpiderLabs · textwebappsmultiple

https://www.exploit-db.com/exploits/18750

View Code ZIP pw:eip

References (5)

[Exploit, Third Party Advisory] http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html

[Exploit, Third Party Advisory, VDB Entry] http://www.exploit-db.com/exploits/18750

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/52989

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/74826

[Third Party Advisory] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/twsl2012-008-multiple-vulnerabilities-in-scrutinizer-netflow-sflow-analyzer/

Scores

CVSS v3 9.8

EPSS 0.1432

EPSS Percentile 94.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

plixer/scrutinizer_netflow_\&_sflow_analyzer 8.6.2.16204 - 9.0.1.19899

Published Jan 09, 2020

Tracked Since Feb 18, 2026