CVE-2012-4951

Multiple SQL injection vulnerabilities in terminal/paramedit.aspx in VeriFone VeriCentre Web Console before 2.2 build 36 allow remote attackers to execute arbitrary SQL commands via the (1) TerminalId, (2) ModelName, or (3) ApplicationName parameter.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
verifonevericentre_web_console
𝑥
≤ 2.2
verifonevericentre_web_console
2.0
verifonevericentre_web_console
2.0.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.clearskies.net/documents/css-advisory-css1211-vericentre.pdf
http://www.kb.cert.org/vuls/id/180091
http://www.securityfocus.com/bid/56409
https://exchange.xforce.ibmcloud.com/vulnerabilities/79832
http://www.clearskies.net/documents/css-advisory-css1211-vericentre.pdf
http://www.kb.cert.org/vuls/id/180091
http://www.securityfocus.com/bid/56409
https://exchange.xforce.ibmcloud.com/vulnerabilities/79832