CVE-2012-5162
OSClass < 2.3.5 - SQL Injection via id Parameter in edit_category_post or enable_category Action
Title source: llmDescription
Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or (2) enable_category action to index.php.
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/78964
Vendor Advisory x_refsource_confirm
http://osclass.org/2012/01/16/osclass-2-3-5/
Patch x_refsource_confirm
https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-1
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/47697
Various Sources x_refsource_misc
http://www.codseq.it/advisories/multiple_vulnerabilities_in_osclass
Scores
EPSS
0.0104
EPSS Percentile
60.5%
Details
CWE
CWE-89
Status
published
Products (1)
osclass/osclass
< 2.3.4
Published
Sep 26, 2012
Tracked Since
Feb 18, 2026