Strix
26.1K

CVE-2012-4237

UnknownEPSS 2.39%

Last modified

CVE-2012-4237 is a vulnerability of currently unknown severity. Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the subject_module_id parameter to (1) tce_edit_answer.php or (2) tce_edit_question.php.. EPSS estimates a 2.39% chance of exploitation in the next 30 days.

Description

Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the subject_module_id parameter to (1) tce_edit_answer.php or (2) tce_edit_question.php.

Metrics

EPSS Probability
2.39%

81.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
TecnickTcexam<= 11.3.007
TecnickTcexam10.1.000
TecnickTcexam10.1.001
TecnickTcexam10.1.002
TecnickTcexam10.1.003
TecnickTcexam10.1.004
TecnickTcexam10.1.005
TecnickTcexam10.1.006
TecnickTcexam10.1.007
TecnickTcexam10.1.008
TecnickTcexam10.1.009
TecnickTcexam10.1.010
TecnickTcexam10.1.011
TecnickTcexam10.1.012
TecnickTcexam10.1.013
TecnickTcexam11.0.000
TecnickTcexam11.0.001
TecnickTcexam11.0.002
TecnickTcexam11.0.003
TecnickTcexam11.0.004
TecnickTcexam11.0.005
TecnickTcexam11.0.006
TecnickTcexam11.0.007
TecnickTcexam11.0.008
TecnickTcexam11.0.009
TecnickTcexam11.0.010
TecnickTcexam11.0.011
TecnickTcexam11.0.012
TecnickTcexam11.0.013
TecnickTcexam11.0.014
TecnickTcexam11.0.015
TecnickTcexam11.0.016
TecnickTcexam11.1.000
TecnickTcexam11.1.001
TecnickTcexam11.1.002
TecnickTcexam11.1.003
TecnickTcexam11.1.004
TecnickTcexam11.1.005
TecnickTcexam11.1.006
TecnickTcexam11.1.007
TecnickTcexam11.1.008
TecnickTcexam11.1.009
TecnickTcexam11.1.010
TecnickTcexam11.1.011
TecnickTcexam11.1.012
TecnickTcexam11.1.013
TecnickTcexam11.1.014
TecnickTcexam11.1.015
TecnickTcexam11.1.016
TecnickTcexam11.1.017

Showing 50 of 101 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2012-4237?
Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the subject_module_id parameter to (1) tce_edit_answer.php or (2) tce_edit_question.php.
How severe is CVE-2012-4237?
Severity scoring for CVE-2012-4237 is pending analysis. The EPSS model estimates a 2.39% probability of exploitation in the next 30 days.
How do I fix CVE-2012-4237?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-4237?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST