« Back to list

CVE-2012-3469

Status: ModifiedHigh (7.5)—

Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the messages admin functionality in application/controllers/admin/messages.php, (2) application/libraries/api/MY_Checkin_Api_Object.php, (3) application/controllers/admin/messages/reporters.php, or (4) the location API in application/libraries/api/MY_Locations_Api_Object.php and application/models/location.php.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Ushahidi — Ushahidi Platform

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2012-3469",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-08-12T21:55:01.417",
  "references": [
    {
      "url": "http://openwall.com/lists/oss-security/2012/08/09/5",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/ushahidi/Ushahidi_Web/commit/68d9916",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/ushahidi/Ushahidi_Web/commit/a11d43c",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/ushahidi/Ushahidi_Web/commit/e0e2b66",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2012/08/09/5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ushahidi/Ushahidi_Web/commit/68d9916",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ushahidi/Ushahidi_Web/commit/a11d43c",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/ushahidi/Ushahidi_Web/commit/e0e2b66",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the messages admin functionality in application/controllers/admin/messages.php, (2) application/libraries/api/MY_Checkin_Api_Object.php, (3) application/controllers/admin/messages/reporters.php, or (4) the location API in application/libraries/api/MY_Locations_Api_Object.php and application/models/location.php."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inyección SQL en la Plataforma Ushahidi anterior a v2.5 permite a atacantes remotos ejecutar comandos SQL a través de vectores relacionados con (1) la funcionalidad de mensajes de administrador en \r\napplication/controllers/admin/messages.php, (2) application/libraries/api/MY_Checkin_Api_Object.php, (3) application/controllers/admin/messages/reporters.php, o (4) la API de localización en application/libraries/api/MY_Locations_Api_Object.php y application/models/location.php."
    }
  ],
  "lastModified": "2026-06-16T23:43:17.270",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ushahidi:ushahidi_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "984B26E4-C672-46DF-B26B-8CAAEDBDFEB0",
              "versionEndIncluding": "2.4.1"
            },
            {
              "criteria": "cpe:2.3:a:ushahidi:ushahidi_platform:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86468BDD-17C2-49CC-A488-F38CC8630979"
            },
            {
              "criteria": "cpe:2.3:a:ushahidi:ushahidi_platform:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8EBC5A6-4FB0-4385-8299-5D6298977534"
            },
            {
              "criteria": "cpe:2.3:a:ushahidi:ushahidi_platform:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "826225E4-F4F8-4FB6-AFAF-23CD6720CE5E"
            },
            {
              "criteria": "cpe:2.3:a:ushahidi:ushahidi_platform:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6754F1ED-E827-433C-8F50-71F04293EEB1"
            },
            {
              "criteria": "cpe:2.3:a:ushahidi:ushahidi_platform:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B1BC250-09BC-4051-ABEE-8B8FE1558279"
            },
            {
              "criteria": "cpe:2.3:a:ushahidi:ushahidi_platform:2.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D260CD2-5483-48D2-87B9-C0298F5F2B23"
            },
            {
              "criteria": "cpe:2.3:a:ushahidi:ushahidi_platform:2.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "489F7397-CF33-42C5-AF46-956D5692C6D1"
            },
            {
              "criteria": "cpe:2.3:a:ushahidi:ushahidi_platform:2.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1C84D59-409A-4E73-A65A-8B12594B61DF"
            },
            {
              "criteria": "cpe:2.3:a:ushahidi:ushahidi_platform:2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A004E65-AFA7-4551-BA2B-8EF9450B0684"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}