VULNERABILITY INTELLIGENCE

CVE-2012-4601

CVSS score6 MEDIUM
EPSS probability1.56%
CISA KEVNot currently listed
Published2012-11-23
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:S/C:P/I:P/A:P

Description

Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the (1) user_groups[] parameter to admin/code/tce_edit_test.php or (2) subject_id parameter to admin/code/tce_show_all_questions.php.

Weakness classification

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references