CVE-2012-10047 — Cyclope Employee Surveillance Solution v6.x SQL Injection
Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not p…
Published: 2025-08-08 · CVSS: 10.0 · CVSS 4.0
Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7