CVE-2012-2962: sonicwall scrutinizer SQL Injection

CVSS: 6.5v2.0MediumModified

Published 30-07-2012Last modified 06-08-2024

Vulnerability summary

CVE-2012-2962 is a medium (CVSS 6.5) SQL Injection vulnerability in sonicwall scrutinizer. EPSS estimates a 66.83% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

49/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v2.0 (NVD)

EPSS score

66.83%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits4reference, exploit-database, metasploit

Timeline

30-07-2012
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.

CVSS metrics

1 score · 1 source · 1 version

v2.06.5

EPSS trend

Probability

66.83%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 66.83% on 18-09-2026

18-09-202618-10-2026

EPSS score

66.83%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasephpVerified
Dell SonicWALL Scrutinizer 9.0.1 - 'statusFilter.php?q' SQL Injection
Maturity: poc
exploit-databaseremotewindowsVerified
Dell SonicWALL Scrutinizer 9 - SQL Injection (Metasploit)
Maturity: weaponized

Show all 4 exploits

MetasploitremoteVerified
Dell SonicWALL (Plixer) Scrutinizer 9 SQL Injection
exploit/windows/http/sonicwall_scrutinizer_sqli
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Sonicwall1 product

scrutinizer< 9.5.2

1 vendor · 1 product

References

8 links

www.osvdb.org/84232VDB EntryX Refsource OSVDBBroken Link
secunia.com/advisories/50052Third Party AdvisoryX Refsource SECUNIA
www.sonicwall.com/shared/…X Refsource CONFIRMBroken LinkVendor Advisory
www.securityfocus.com/bid/54625VDB EntryX Refsource BIDExploitThird Party Advisory
www.exploit-db.com/exploits/20033ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.plixer.com/Press-Releases/plixer-releases-9-5-2.htmlX Refsource CONFIRMThird Party Advisory
www.kb.cert.org/vuls/id/404051Third Party AdvisoryX Refsource CERT VNUS Government Resource
exchange.xforce.ibmcloud.com/vulnerabilities/77148VDB EntryX Refsource XFThird Party Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities