CVE-2012-2962 : SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka D

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.

Published 2012-07-30 22:55:03

Updated 2025-04-11 00:51:22

Source CERT/CC

View at NVD, CVE.org

Vulnerability category: Sql Injection

Products affected by CVE-2012-2962

Sonicwall » Scrutinizer
Versions before (<) 9.5.2
cpe:2.3:a:sonicwall:scrutinizer:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2012-2962

EPSS FAQ

90.34%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2012-2962

Dell SonicWALL (Plixer) Scrutinizer 9 SQL Injection

Disclosure Date: 2012-07-22

First seen: 2020-04-26

exploit/windows/http/sonicwall_scrutinizer_sqli

This module exploits a vulnerability found in Dell SonicWall Scrutinizer. While handling the 'q' parameter, the PHP application does not properly filter the user-supplied data, which can be manipulated to inject SQL commands, and then gain remote code execution. P

More information

CVSS scores for CVE-2012-2962

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2012-2962

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-2962

http://www.plixer.com/Press-Releases/plixer-releases-9-5-2.html

Press Release Archive – Plixer
Third Party Advisory

CVEs referencing this url
http://www.kb.cert.org/vuls/id/404051

VU#404051 - Dell SonicWALL Scrutinizer SQL injection vulnerability
Third Party Advisory;US Government Resource
http://www.sonicwall.com/shared/download/Dell_SonicWALL_Scrutinizer_Service_Bulletin_for_SQL_injection_vulnerability_CVE.pdf

Page Not Found
Broken Link;Vendor Advisory
http://www.securityfocus.com/bid/54625

Dell SonicWALL Scrutinizer 'q' Parameter SQL Injection Vulnerability
Exploit;Third Party Advisory;VDB Entry
http://secunia.com/advisories/50052

Sign in
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/77148

Dell SonicWALL Scrutinizer statusFilter.php SQL injection CVE-2012-2962 Vulnerability Report
Third Party Advisory;VDB Entry
http://www.osvdb.org/84232

404 Not Found
Broken Link
http://www.exploit-db.com/exploits/20033

Dell SonicWALL Scrutinizer 9.0.1 - 'statusFilter.php?q' SQL Injection - PHP webapps Exploit
Exploit;Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2012-2962