CVE-2012-0805

Public PoC / Exploit (1)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.

Weaknesses (CWE)

CWE-89

Affected Products (14)

sqlalchemy · sqlalchemyvulnerable

References (20)

http://rhn.redhat.com/errata/RHSA-2012-0369.html

http://secunia.com/advisories/48327

Vendor Advisory

http://secunia.com/advisories/48328

Vendor Advisory

http://secunia.com/advisories/48771

Vendor Advisory

http://www.debian.org/security/2012/dsa-2449

http://www.mandriva.com/security/advisories?name=MDVSA-2012:059

http://www.sqlalchemy.org/changelog/CHANGES_0_7_0

http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/

ExploitPatch

https://bugs.launchpad.net/keystone/+bug/918608