CVE-2012-3820 json
Multiple SQL injection vulnerabilities in Campaign11.exe in Arial Software Campaign Enterprise before 11.0.551 allow remote attackers to ex…
published 2014-08-14 12 y ago modified 2026-06-16 4 mo ago also EUVD-2012-3767
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
Multiple SQL injection vulnerabilities in Campaign11.exe in Arial Software Campaign Enterprise before 11.0.551 allow remote attackers to execute arbitrary SQL commands via the (1) SerialNumber field to activate.asp or (2) UID field to User-Edit.asp.
Exploit prediction
2.08% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- sadgeeksinsnow.blogspot.dk http://sadgeeksinsnow.blogspot.dk/2012/10/my-first-experiences-bug-hunting-part-2.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
sadgeeksinsnow.blogspot.dk
/2012/10/my-first-experiences-bug-hunting-part-2.html
exploit
-
secunia.com
/advisories/50969
third-party-advisory
-
osvdb.org
/86492
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/79507
vdb-entry
-
osvdb.org
/86491
vdb-entry
Sources
- CVE List CVE-2012-3820
- NVD CVE-2012-3820
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.