CVE-2012-2171 EXPLOIT
6.5
MEDIUM · CVSS 2.0 · EPSS 5.1% (pctl 92)
Patch early
A public exploit exists.
Description
SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote authenticated users to execute arbitrary SQL commands via the selectedModuleOnly parameter in a state_viewmodulelog action to the ModuleServlet URI.
Scoring
| CVSS | 6.5 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| EPSS | 5.14% — more likely to be exploited than 92% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2012-06-22 |
| Last modified | 2026-06-16 |
Affected (18)
| Vendor | Product |
|---|---|
| ibm | ds storage manager host software |
| ibm | ds4100 |
| ibm | ds4200 |
| ibm | ds4300 |
| ibm | ds4400 |
| ibm | ds4500 |
| ibm | ds4700 |
| ibm | ds4800 |
| ibm | system storage dcs3700 storage subsystem |
| ibm | system storage ds3200 |
| ibm | system storage ds3300 |
| ibm | system storage ds3400 |
| ibm | system storage ds3512 |
| ibm | system storage ds3524 |
| ibm | system storage ds3950 express |
| ibm | system storage ds5020 disk controller |
| ibm | system storage ds5100 storage controller |
| ibm | system storage ds5300 storage controller |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | IBM System Storage DS Storage Manager Profiler - Multiple Vulnerabilities | 2012-06-21 |
References
- http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
- http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75236
- http://www.ibm.com/connections/blogs/PSIRT/entry/secbulletin_stg-storage_cve-2012-2171_cve-2012-2172
- http://www.zeroscience.mk/codes/ibmssdssmp_sqlixss.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75236
→ the Explorer · watch your stack · NVD