NetSight
IP …
medium6.8Public exploit code

CVE-2012-4237

Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL …

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the subject_module_id parameter to (1) tce_edit_answer.php or (2) tce_edit_question.php.

Affected products

VendorProductAffected versions
TecnickTcexam
through 11.3.007
Versions 10.1.000, 10.1.001, 10.1.002, 10.1.003, 10.1.004

Weakness classification

CWE-89

References