CVE-2012-5878
Last modified
CVE-2012-5878 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.. EPSS estimates a 9.30% chance of exploitation in the next 30 days.
Description
Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bulbsecurity | Smartphone Pentest Framework | >= 0.1.2, <= 0.1.4 |
References
- https://www.htbridge.com/advisory/HTB23123Not Applicable, Third Party Advisory
- https://www.htbridge.com/advisory/HTB23127Exploit, Third Party Advisory
- https://www.htbridge.com/advisory/HTB23123Not Applicable, Third Party Advisory
- https://www.htbridge.com/advisory/HTB23127Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2012-5878?
How severe is CVE-2012-5878?
How do I fix CVE-2012-5878?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-5872ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection…9.8
- CVE-2012-5873ARC (aka ARC2) through 2011-12-01 allows reflected XSS via t…6.1
- CVE-2012-5874Multiple SQL injection vulnerabilities in the (1) update_who…
- CVE-2012-5875Firefly Media Server 1.0.0.1359 allows remote attackers to c…
- CVE-2012-5876Multiple off-by-one errors in NMMediaServerService.dll in Ne…
- CVE-2012-5877Nero MediaHome 4.5.8.0 and earlier allows remote attackers t…
- CVE-2012-5879An ActiveX control in McHealthCheck.dll in McAfee Virtual Te…
- CVE-2012-5881Cross-site scripting (XSS) vulnerability in the Flash compon…
- CVE-2012-5882Cross-site scripting (XSS) vulnerability in the Flash compon…
- CVE-2012-5883Cross-site scripting (XSS) vulnerability in the Flash compon…
- CVE-2012-5884The User.get method in Bugzilla/WebService/User.pm in Bugzil…
- CVE-2012-5885The replay-countermeasure functionality in the HTTP Digest A…
Are you affected by CVE-2012-5878?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST