CVE-2012-4260
CVE-2012-4260
Multiple SQL injection vulnerabilities in myCare2x allow remote attackers to execute arbitrary SQL commands via the (1) aktion or (2) callurl parameter to modules/patient/mycare2x_pat_info.php; (3) dept_nr or (4) pid parameter to modules/importer/mycare2x_importer.php; (5) myOpsEintrag or (6) keyword parameter in a Suchen action to modules/drg/mycare2x_proc_search.php; or (7) name_last or (8) pid parameter to modules/patient/mycare_pid.php.
Affected products
n/a · n/apublic PoCs found — 3
cve_referencepacketstormsecurity.org/files/112462/myCare2x-CMS-Cross-Site-Scripting-SQL-Injection.htmlunverifiedcve_referencewww.exploit-db.com/exploits/18844unverifiedexploitdbwww.exploit-db.com/exploits/18844unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://packetstormsecurity.org/files/112462/myCare2x-CMS-Cross-Site-Scripting-SQL-Injection.htmlhttp://secunia.com/advisories/49029https://exchange.xforce.ibmcloud.com/vulnerabilities/75390http://www.exploit-db.com/exploits/18844http://www.osvdb.org/81685http://www.osvdb.org/81686http://www.securityfocus.com/bid/53392http://www.vulnerability-lab.com/get_content.php?id=524