EDB-38016

functional

ESRI ArcGIS for Server - 'where' SQL Injection

view exploit source exploit_dbverifiedtype webappsauthor anonymouspublished 2012-11-09catalog exploit_db

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2012-4949US	medium6.5	4.39% (91st)	Exploit	2012-11-14
SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.