CVE-2012-1258

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities2012-04-19 · webapps · multiple · Verified

Impact

cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote attackers to add user accounts with administrator privileges via the newuser, pwd, and selectedUserGroup parameters.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html
• http://www.exploit-db.com/exploits/18750
• http://www.securityfocus.com/bid/52989
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74824
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/twsl2012-008-multiple-vulnerabilities-in-scrutinizer-netflow-sflow-analyzer/
• http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html
• http://www.exploit-db.com/exploits/18750
• http://www.securityfocus.com/bid/52989
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74824
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/twsl2012-008-multiple-vulnerabilities-in-scrutinizer-netflow-sflow-analyzer/