CVE-2012-2998

Trend Micro Control Manager <5.5.0.1823, <6.0.0.1449 - SQL Injection

Title source: llm

Description

SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Exploits (1)

exploitdb WORKING POC VERIFIED

by otoy · pythonwebappswindows

https://www.exploit-db.com/exploits/21546

View Code ZIP pw:eip

References (8)

Core 8

Core References

Patch x_refsource_misc

http://www.spentera.com/2012/09/trend-micro-control-manager-sql-injection-vulnerability/

Patch third-party-advisory x_refsource_jvndb

http://jvndb.jvn.jp/jvndb/JVNDB-2012-000090

Patch x_refsource_confirm

http://www.trendmicro.com/ftp/documentation/readme/readme_critical_patch_tmcm60_patch1_1449.txt

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1027584

Patch x_refsource_confirm

http://www.trendmicro.com/ftp/documentation/readme/readme_critical_patch_TMCM55_1823.txt

US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/950795

Vendor Advisory x_refsource_confirm

http://esupport.trendmicro.com/solution/en-us/1061043.aspx

Patch third-party-advisory x_refsource_jvn

http://jvn.jp/en/jp/JVN42014489/index.html

Scores

EPSS 0.0979

EPSS Percentile 93.0%

Details

CWE

CWE-89

Status published

Products (9)

trend_micro/control_manager 2.0

trend_micro/control_manager 2.1

trend_micro/control_manager 2.5

trend_micro/control_manager 3.0 (2 CPE variants)

trend_micro/control_manager 3.5 (2 CPE variants)

trend_micro/control_manager 5.0 (2 CPE variants)

trend_micro/control_manager 5.5

trend_micro/control_manager 6.0

trend_micro/control_manager < 5.5

Published Sep 28, 2012

Tracked Since Feb 18, 2026