Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2010-0112 Details

Description

Multiple SQL injection vulnerabilities in the Administrative Interface in the IIS extension in Symantec IM Manager before 8.4.16 allow remote attackers to execute arbitrary SQL commands via (1) the rdReport parameter to rdpageimlogic.aspx, related to the sGetDefinition function in rdServer.dll, and SQL statements contained within a certain report file; (2) unspecified parameters in a DetailReportGroup (aka DetailReportGroup.lgx) action to rdpageimlogic.aspx; the (3) selclause, (4) whereTrendTimeClause, (5) TrendTypeForReport, (6) whereProtocolClause, or (7) groupClause parameter in a SummaryReportGroup (aka SummaryReportGroup.lgx) action to rdpageimlogic.aspx; the (8) loginTimeStamp, (9) dbo, (10) dateDiffParam, or (11) whereClause parameter in a LoggedInUsers (aka LoggedInUSers.lgx) action to (a) rdpageimlogic.aspx or (b) rdPage.aspx; the (12) selclause, (13) whereTrendTimeClause, (14) TrendTypeForReport, (15) whereProtocolClause, or (16) groupClause parameter to rdpageimlogic.aspx; (17) the groupList parameter to IMAdminReportTrendFormRun.asp; or (18) the email parameter to IMAdminScheduleReport.asp.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://osvdb.org/68901	CVE
http://osvdb.org/68902	CVE
http://osvdb.org/68903	CVE
http://secunia.com/advisories/41959	CVE	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/62806	CVE
http://www.securityfocus.com/bid/44299	CVE
http://www.securitytracker.com/id?1024648	CVE
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20101027_01	CVE
http://www.vupen.com/english/advisories/2010/2789	CVE	Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-10-220/	CVE
http://www.zerodayinitiative.com/advisories/ZDI-10-221/	CVE
http://www.zerodayinitiative.com/advisories/ZDI-10-222/	CVE
http://www.zerodayinitiative.com/advisories/ZDI-10-223/	CVE
http://www.zerodayinitiative.com/advisories/ZDI-10-224/	CVE
http://www.zerodayinitiative.com/advisories/ZDI-10-225/	CVE
http://www.zerodayinitiative.com/advisories/ZDI-10-226/	CVE
http://osvdb.org/68901	[email protected]
http://osvdb.org/68902	[email protected]
http://osvdb.org/68903	[email protected]
http://secunia.com/advisories/41959	[email protected]	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/62806	[email protected]
http://www.securityfocus.com/bid/44299	[email protected]
http://www.securitytracker.com/id?1024648	[email protected]
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20101027_01	[email protected]
http://www.vupen.com/english/advisories/2010/2789	[email protected]	Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-10-220/	[email protected]
http://www.zerodayinitiative.com/advisories/ZDI-10-221/	[email protected]
http://www.zerodayinitiative.com/advisories/ZDI-10-222/	[email protected]
http://www.zerodayinitiative.com/advisories/ZDI-10-223/	[email protected]
http://www.zerodayinitiative.com/advisories/ZDI-10-224/	[email protected]
http://www.zerodayinitiative.com/advisories/ZDI-10-225/	[email protected]
http://www.zerodayinitiative.com/advisories/ZDI-10-226/	[email protected]

see all 32 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	[email protected]

Affected Products

Product	Versions
symantec im manager	<= 8.4.15 6.0 6.5 7.0 7.5
CPE cpe:2.3:a:symantec:im_manager:::::::: cpe:2.3:a:symantec:im_manager:6.0:::::::* cpe:2.3:a:symantec:im_manager:6.5:::::::* cpe:2.3:a:symantec:im_manager:7.0:::::::* cpe:2.3:a:symantec:im_manager:7.5:::::::* cpe:2.3:a:symantec:im_manager:8.3:::::::* cpe:2.3:a:symantec:im_manager:8.4.0:::::::* cpe:2.3:a:symantec:im_manager:8.4.1:::::::* cpe:2.3:a:symantec:im_manager:8.4.2:::::::* cpe:2.3:a:symantec:im_manager:8.4.5:::::::* cpe:2.3:a:symantec:im_manager:8.4.6:::::::* cpe:2.3:a:symantec:im_manager:8.4.7:::::::* cpe:2.3:a:symantec:im_manager:8.4.8:::::::* cpe:2.3:a:symantec:im_manager:8.4.9:::::::* cpe:2.3:a:symantec:im_manager:8.4.10:::::::* cpe:2.3:a:symantec:im_manager:8.4.11:::::::* cpe:2.3:a:symantec:im_manager:8.4.12:::::::* cpe:2.3:a:symantec:im_manager:8.4.13:::::::* Remediation No remediation found in references.

Product

Versions

symantec im manager

<= 8.4.15

6.0

6.5

7.0

7.5

CPE

cpe:2.3:a:symantec:im_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:6.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:6.5:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:7.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:7.5:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.3:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.2:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.5:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.6:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.7:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.8:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.9:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.10:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.11:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.12:*:*:*:*:*:*:*
cpe:2.3:a:symantec:im_manager:8.4.13:*:*:*:*:*:*:*

Remediation

No remediation found in references.

Change History

6 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 29, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Aug 17, 2017	CVE Modified	[email protected]
Oct 29, 2010	Initial Analysis	[email protected]