SQL Injection in Cyclope-Series Cyclope Employee Surveillance Solution
CVE-2012-10047
Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context.
Vulnerability class: SQL Injection
Published · last modified .
EPSS exploit prediction
EPSS: 0.013 (69.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 69.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.013 · change: +0.004
Affected products
- Cyclope-Series Cyclope Employee Surveillance Solution — versions 6.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/w… (exploit)
- www.exploit-db.com/exploits/20393 (exploit)
- www.exploit-db.com/exploits/20501 (exploit)
- www.cyclope-series.com/ (product)
- www.vulncheck.com/advisories/cyclope-employee-surveillance-solution-sql-injecti… (third-party-advisory)
Frequently asked questions
- What is CVE-2012-10047?
- CVE-2012-10047 is a vulnerability in Cyclope-Series Cyclope Employee Surveillance Solution, classified under SQL Injection. Published 2025-08-08.
- Is CVE-2012-10047 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.