CVE-2012-10047PoC

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

PoC

1100.0%

Referenced assets1 URL

By indicator

https://zerodaysignal.com/vulnerability/CVE-2012-10047

Full discourse1 post

0day Signal@0dayPublishing198d
PoC
🚨 CVE-2012-10047: Cyclope E... SQL-to-RCE chain on employee surveillance software means the watchers become the watched - SYSTEM shells via login bypass. #SQLinjection #RCE. https://zerodaysignal.com/vulnerability/CVE-2012-10047 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE‑2012‑10047 as a SQL injection that can be chained to RCE in Cyclope E employee‑surveillance software, linking to a site that likely hosts a proof‑of‑concept.
0000048
162 followersView on X

Explore more

Back to dashboard