CVE-2012-4237
TCExam < 11.3.008 - Authenticated SQL Injection via subject_module_id Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-4237. PoCs published by Chris Cooper.
AI-analyzed exploit summary The provided text describes a SQL injection vulnerability in TCExam versions prior to 11.3.008, where the 'subject_module_id' parameter in 'tce_edit_question.php' is not properly sanitized. This allows attackers to manipulate SQL queries, potentially compromising the application or underlying database.
Description
Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the subject_module_id parameter to (1) tce_edit_answer.php or (2) tce_edit_question.php.
Exploits (2)
The provided text describes a SQL injection vulnerability in TCExam versions prior to 11.3.008, where the 'subject_module_id' parameter in 'tce_edit_question.php' is not properly sanitized. This allows attackers to manipulate SQL queries, potentially compromising the application or underlying database.
The provided text describes SQL injection vulnerabilities in TCExam versions prior to 11.3.008, specifically in the 'tce_edit_answer.php' endpoint via the 'subject_module_id' and 'question_subject_id' parameters. It lacks functional exploit code but provides technical details about the vulnerability.