CVE-2012-2998

Trend Micro Control Manager <5.5.0.1823, <6.0.0.1449 - SQL Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-2998. PoCs published by otoy.

AI-analyzed exploit summary This Python script exploits a time-based blind SQL injection vulnerability in Trend Micro Control Manager 5.5/6.0 via the AdHocQuery module. It extracts password hashes from the database by leveraging the 'id' parameter and measuring response delays.

Description

SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Exploits (1)

exploitdb WORKING POC VERIFIED

by otoy · pythonwebappswindows

https://www.exploit-db.com/exploits/21546

View Code ZIP pw:eip

This Python script exploits a time-based blind SQL injection vulnerability in Trend Micro Control Manager 5.5/6.0 via the AdHocQuery module. It extracts password hashes from the database by leveraging the 'id' parameter and measuring response delays.

Classification

Working Poc 95%

Attack Type

Sqli

Complexity

Moderate

Reliability

Reliable

Target: Trend Micro Control Manager 5.5/6.0

Auth required

Prerequisites: Valid session cookie (ASP_NET_SessionId, .ASPXAUTH, WFINFOR) · Network access to the target web application

MITRE ATT&CK