CVE-2012-10047
NONE—CVSS v3
—CVSS v2
71.17%
EPSS (exploit probability)
CWE-89CWE
Description
Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context.
Affected routers (0)
No routers currently mapped to this CVE in our database.