Description

Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the (1) user_groups[] parameter to admin/code/tce_edit_test.php or (2) subject_id parameter to admin/code/tce_show_all_questions.php.

Remediation

References

CVE-2012-4601

Related Vulnerabilities

MySQL Other Vulnerability (CVE-2002-0969)

WordPress Plugin All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs-My Sticky Elements Cross-Site Scripting (2.0.3)

MySQL CVE-2021-2278 Vulnerability (CVE-2021-2278)

Liferay DXP Inefficient Regular Expression Complexity Vulnerability (CVE-2022-42124)

WordPress Plugin Passster-Password Protection Security Bypass (3.5.5.8)

Severity

Medium

Classification

CVE-2012-4601 CWE-138

Tags

Missing Update Known Vulnerabilities