CVE-2012-2762
Serendipity < 1.6.1 - SQL Injection via URL Parameter to comment.php
Title source: llmDescription
SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php.
References (8)
Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/82036
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/53620
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/49234
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/75760
Vendor Advisory x_refsource_misc
https://www.htbridge.com/advisory/HTB23092
Vendor Advisory x_refsource_confirm
http://blog.s9y.org/archives/241-Serendipity-1.6.2-released.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1027079
Patch x_refsource_confirm
https://github.com/s9y/Serendipity/commit/87153991d06bc18fe4af05f97810487c4a340a92#diff-1
Scores
EPSS
0.0222
EPSS Percentile
80.8%
Details
CWE
CWE-89
Status
published
Products (35)
s9y/serendipity
0.3
s9y/serendipity
0.4
s9y/serendipity
0.7
s9y/serendipity
0.7.1
s9y/serendipity
0.8
s9y/serendipity
0.8.1
s9y/serendipity
0.8.2
s9y/serendipity
0.8.3
s9y/serendipity
0.8.4
s9y/serendipity
0.8.5
... and 25 more
Published
Jun 07, 2012
Tracked Since
Feb 18, 2026