Back to KEVs

CVE-2012-1557

SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x...

Basic Information

CVE State
PUBLISHED
Reserved Date
March 12, 2012
Published Date
March 12, 2012
Last Updated
August 06, 2024
Vendor
Parallels
Product
Plesk Panel
Description
SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in March 2012.
Tags
php

CVSS Scores

CVSS v2.0

7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploit Status

Exploited in the Wild
Yes (2012-03-12 19:00:00 UTC) Source

References

http://www.h-online.com/security/news/item/Bug-in-Plesk-administration-software-is-being-actively-exploited-1446587.html http://kb.parallels.com/en/113321 http://www.osvdb.org/79769 http://www.openwall.com/lists/oss-security/2012/03/08/3 http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-windows-updates-release-notes.html#10216 https://exchange.xforce.ibmcloud.com/vulnerabilities/73628 http://secunia.com/advisories/48262 http://www.securityfocus.com/bid/52267 http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-linux-updates-release-notes.html#10216 http://www.cert.fi/haavoittuvuudet/2012/haavoittuvuus-2012-035.html http://www.securitytracker.com/id?1026760

Known Exploited Vulnerability Information

Source Added Date
CVE 2012-03-12 19:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel