medium6.5Public exploit code
CVE-2012-2171
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series device…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- IBM System Storage DS Storage Manager Profiler - Multiple Vulnerabilities2012-06-21 · webapps · windows
Impact
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ibm | Ds Storage Manager Host Software | through 10.83 Versions 10.8, 10.60.x5.14 |
| Ibm | Ds4100 | All versions Version 1724 |
| Ibm | Ds4200 | Version 1814 |
| Ibm | Ds4300 | Version 1722 |
| Ibm | Ds4400 | Version 1742 |
| Ibm | Ds4500 | Version 1742 |
| Ibm | Ds4700 | Version 1814 |
| Ibm | Ds4800 | Version 1815 |
| Ibm | System Storage Dcs3700 Storage Subsystem | Version 1818 |
| Ibm | System Storage Ds3200 | Version 1726 |
| Ibm | System Storage Ds3300 | Version 1726 |
| Ibm | System Storage Ds3400 | Version 1726 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
- http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75236
- http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
- http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75236