CVE-2012-4673

SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL commands via vectors involving the sort_col variable in the list_items function, a different vulnerability than CVE-2012-3477.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
VendorProductVersion
thomas_hunterneoinvoice
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://adamcaudill.com/2012/08/12/neoinvoice-blind-sql-injection-cve-2012-3477/
https://github.com/mweimerskirch/neoinvoice/commit/501a9d5d261c718913cfc13d212b09b56f3bf087
https://github.com/tlhunter/neoinvoice/issues/2
http://adamcaudill.com/2012/08/12/neoinvoice-blind-sql-injection-cve-2012-3477/
https://github.com/mweimerskirch/neoinvoice/commit/501a9d5d261c718913cfc13d212b09b56f3bf087
https://github.com/tlhunter/neoinvoice/issues/2