CVE Feed

    Dashboard / CVE / CVE-2012-1557

    CVE-2012-1557

    SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in March 2012.

    Published:Mar 12, 2012
    Last Modified:Apr 11, 2025
    EPS:Mar 12, 2012
    EPSS Score:0.01044
    CVSS Score:7.5

    Affected Products

    Vendor
    Parallels
    Product
    Parallels Plesk Panel

    Exploits

    No exploit reference

    Related CVEs

    CVE-2019-18793 (CVSS 6.1) — Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter.…
    CVE-2013-4878 (CVSS 7.5) — The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on U…
    CVE-2013-0132 (CVSS 6.8) — The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows…
    CVE-2013-0133 (CVSS 7.2) — Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allow…
    CVE-2011-4738 (CVSS 5) — The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 does not include the HTTPOnly flag in a Se…
    CVE-2011-4735 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build…
    CVE-2011-4731 (CVSS 5) — The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 includes an RFC 1918 IP add…
    CVE-2011-4745 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1_bui…
    CVE-2011-4742 (CVSS 5) — The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses …
    CVE-2011-4733 (CVSS 10) — The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 sends incorrect Content-Typ…

    References

    http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-linux-updates-release-notes.html#10216
    http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-windows-updates-release-notes.html#10216
    http://kb.parallels.com/en/113321
    http://secunia.com/advisories/48262
    http://www.cert.fi/haavoittuvuudet/2012/haavoittuvuus-2012-035.html
    http://www.h-online.com/security/news/item/Bug-in-Plesk-administration-software-is-being-actively-exploited-1446587.html
    http://www.openwall.com/lists/oss-security/2012/03/08/3
    http://www.osvdb.org/79769
    http://www.securityfocus.com/bid/52267
    http://www.securitytracker.com/id?1026760
    https://exchange.xforce.ibmcloud.com/vulnerabilities/73628
    http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-linux-updates-release-notes.html#10216
    http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-windows-updates-release-notes.html#10216
    http://kb.parallels.com/en/113321
    http://secunia.com/advisories/48262
    http://www.cert.fi/haavoittuvuudet/2012/haavoittuvuus-2012-035.html
    http://www.h-online.com/security/news/item/Bug-in-Plesk-administration-software-is-being-actively-exploited-1446587.html
    http://www.openwall.com/lists/oss-security/2012/03/08/3
    http://www.osvdb.org/79769
    http://www.securityfocus.com/bid/52267
    http://www.securitytracker.com/id?1026760
    https://exchange.xforce.ibmcloud.com/vulnerabilities/73628

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High