FKIE_CVE-2012-0693

Vulnerability from fkie_nvd - Published: 2012-01-14 03:57 - Updated: 2026-06-16 23:38
Severity
Summary
submitticket.php in WHMCompleteSolution (WHMCS) 5.03 allows remote attackers to inject arbitrary code into a subject field via crafted ticket data, a different vulnerability than CVE-2011-5061. NOTE: the vendor disputes this issue, noting that some of the details overlap CVE-2011-5061, but that it "says it affects V5.0.3, and the submitticket.php file, both of which are wrong.
References
cve@mitre.orghttp://www.oscommerceuniversity.com/lounge/index.php/board%2C23.0.htmlURL Repurposed
cve@mitre.orghttp://www.oscommerceuniversity.com/lounge/index.php/topic%2C1209.0.htmlURL Repurposed
af854a3a-2127-422b-91ae-364da2661108http://www.oscommerceuniversity.com/lounge/index.php/board%2C23.0.htmlURL Repurposed
af854a3a-2127-422b-91ae-364da2661108http://www.oscommerceuniversity.com/lounge/index.php/topic%2C1209.0.htmlURL Repurposed
Impacted products
Vendor Product Version
whmcs whmcompletesolution 5.03
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:whmcs:whmcompletesolution:5.03:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F4A3A75-735B-49B4-8739-9ABB95A5F0D8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [
    {
      "sourceIdentifier": "cve@mitre.org",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "submitticket.php in WHMCompleteSolution (WHMCS) 5.03 allows remote attackers to inject arbitrary code into a subject field via crafted ticket data, a different vulnerability than CVE-2011-5061. NOTE: the vendor disputes this issue, noting that some of the details overlap CVE-2011-5061, but that it \"says it affects V5.0.3, and the submitticket.php file, both of which are wrong."
    },
    {
      "lang": "es",
      "value": "** DISPUTADA ** submitticket.php en WHMCompleteSolution (WHMCS) 5.03 permite a atacantes remotos inyectar c\u00f3digo arbitrario en un campo subject a trav\u00e9s de datos de ticket manipulados, una vulnerabilidad diferente a CVE-2011-5061. NOTA: el proveedor disputa este problema, anota que algunos de los detalles solapan el CVE-2011-5061, pero que \u0027dice que afecta V5.0.3, y el fichero submitticket.php, ambos siendo err\u00f3neos.\u0027"
    }
  ],
  "id": "CVE-2012-0693",
  "lastModified": "2026-06-16T23:38:05.320",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-01-14T03:57:27.213",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "URL Repurposed"
      ],
      "url": "http://www.oscommerceuniversity.com/lounge/index.php/board%2C23.0.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "URL Repurposed"
      ],
      "url": "http://www.oscommerceuniversity.com/lounge/index.php/topic%2C1209.0.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "URL Repurposed"
      ],
      "url": "http://www.oscommerceuniversity.com/lounge/index.php/board%2C23.0.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "URL Repurposed"
      ],
      "url": "http://www.oscommerceuniversity.com/lounge/index.php/topic%2C1209.0.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.