CVE-2012-2576
CRITICALSolarWinds Backup Profiler < 5.1.2 - SQL Injection via LoginServlet loginName Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-2576.
PoCs published by Metasploit, muts, r@b13$, muts, sinn3r, including Metasploit module exploits/windows/http/solarwinds_storage_manager_sql.
AI-analyzed exploit summary This Metasploit module exploits a SQL injection vulnerability in SolarWinds Storage Manager 5.1.0 to achieve remote code execution by injecting a malicious JSP payload into the web root directory, which then downloads and executes a malicious executable.
Description
SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field.
Exploits (3)
This Metasploit module exploits a SQL injection vulnerability in SolarWinds Storage Manager 5.1.0 to achieve remote code execution by injecting a malicious JSP payload into the web root directory, which then downloads and executes a malicious executable.
This exploit leverages a SQL injection vulnerability in SolarWinds Storage Manager 5.1.0 to write a JSP shell to the server, which then establishes a reverse shell connection to the attacker's specified host and port.
This Metasploit module exploits a SQL injection vulnerability in SolarWinds Storage Manager 5.1.0 to create a JSP file under the web root directory, which then downloads and executes a malicious payload under the context of SYSTEM.
References (5)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H