CVE-2012-5327

CVSS V2 Medium 6.5 CVSS V3 None

Description

Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) delete_usrgrp[] parameter in a delete_usergroups action, (2) usergroup parameter in an add_user_togroup action, or (3) add_forum_group_id parameter in an add_forum_submit action.

Overview

CVE ID
CVE-2012-5327

Assigner
cve@mitre.org

Vulnerability Status
Modified

Published Version
2012-10-08T20:55:01

Last Modified Date
2017-08-29T01:32:38

Weakness Enumerations

CWE	URL
CWE-89	http://cwe.mitre.org/data/definitions/89.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
		AND
cpe:2.3:a:cartpauj:mingle-forum::::::::	1	OR	1.0.32.1
cpe:2.3:a:cartpauj:mingle-forum:1.0.00:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.01:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.02:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.03:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.04:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.05:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.06:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.07:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.08:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.09:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.10:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.11:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.12:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.13:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.14:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.15:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.16:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.17:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.18:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.19:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.20:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.21:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.21.1:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.22:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.23:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.23.1:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.23.2:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.24:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.25:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.26:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.27:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.28:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.28.1:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.28.2:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.29:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.30:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.31:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.31.1:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.31.2:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.31.3:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.31.4:::::::*	1	OR
cpe:2.3:a:cartpauj:mingle-forum:1.0.32:::::::*	1	OR
cpe:2.3:a:wordpress:wordpress:-:::::::*	0	OR

CVSS Version 2

Version
2.0

Vector String
AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector
NETWORK

Access Compatibility
LOW

Authentication
SINGLE

Confidentiality Impact
PARTIAL

Integrity Impact
PARTIAL

Availability Impact
PARTIAL

Base Score
6.5

Severity
MEDIUM

Exploitability Score
8

Impact Score
6.4

References

Reference URL	Reference Tags
http://plugins.trac.wordpress.org/changeset?reponame=&new=492859@mingle-forum&old=487353@mingle-forum
http://packetstormsecurity.org/files/view/108915/wpmingleforum-sqlxss.txt	Exploit
http://wordpress.org/extend/plugins/mingle-forum/changelog/
https://exchange.xforce.ibmcloud.com/vulnerabilities/72641

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2012-5327
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5327

History

Created	Old Value	New Value	Data Type	Notes
2022-05-10 08:48:02				Added to TrackCVE