{"api_version":"1","generated_at":"2026-07-23T10:40:21+00:00","cve":"CVE-2012-5695","urls":{"html":"https://cve.report/CVE-2012-5695","api":"https://cve.report/api/cve/CVE-2012-5695.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-5695","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-5695"},"summary":{"title":"CVE-2012-5695","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS message.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-10-20 16:55:05","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://www.htbridge.com/advisory/HTB23127","name":"https://www.htbridge.com/advisory/HTB23127","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"File Not Found","mime":"text/html","httpstatus":"404","archivestatus":"403"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80313","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80313","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/87327","name":"http://osvdb.org/87327","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://twitter.com/georgiaweidman/statuses/269138431567855618","name":"https://twitter.com/georgiaweidman/statuses/269138431567855618","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Georgia Weidman on Twitter: \"SPF GUI back in may god and infosec forgive me: https://t.co/ufeMXnmb\"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51415","name":"http://secunia.com/advisories/51415","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA51415 - Smartphone Pentest Framework frameworkgui Multiple Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.htbridge.com/advisory/HTB23123","name":"https://www.htbridge.com/advisory/HTB23123","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"File Not Found","mime":"text/html","httpstatus":"404","archivestatus":"403"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5695","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5695","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"5695","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bulbsecurity","cpe5":"smartphone_pentest_framework","cpe6":"0.1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5695","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bulbsecurity","cpe5":"smartphone_pentest_framework","cpe6":"0.1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5695","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bulbsecurity","cpe5":"smartphone_pentest_framework","cpe6":"0.1.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T21:14:16.402Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"87327","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/87327"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.htbridge.com/advisory/HTB23123"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://twitter.com/georgiaweidman/statuses/269138431567855618"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.htbridge.com/advisory/HTB23127"},{"name":"spf-guesspassword-csrf(80313)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80313"},{"name":"51415","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51415"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-11-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS message."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"87327","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/87327"},{"tags":["x_refsource_MISC"],"url":"https://www.htbridge.com/advisory/HTB23123"},{"tags":["x_refsource_MISC"],"url":"https://twitter.com/georgiaweidman/statuses/269138431567855618"},{"tags":["x_refsource_MISC"],"url":"https://www.htbridge.com/advisory/HTB23127"},{"name":"spf-guesspassword-csrf(80313)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80313"},{"name":"51415","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51415"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2012-5695","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS message."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"87327","refsource":"OSVDB","url":"http://osvdb.org/87327"},{"name":"https://www.htbridge.com/advisory/HTB23123","refsource":"MISC","url":"https://www.htbridge.com/advisory/HTB23123"},{"name":"https://twitter.com/georgiaweidman/statuses/269138431567855618","refsource":"MISC","url":"https://twitter.com/georgiaweidman/statuses/269138431567855618"},{"name":"https://www.htbridge.com/advisory/HTB23127","refsource":"MISC","url":"https://www.htbridge.com/advisory/HTB23127"},{"name":"spf-guesspassword-csrf(80313)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80313"},{"name":"51415","refsource":"SECUNIA","url":"http://secunia.com/advisories/51415"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2012-5695","datePublished":"2014-10-20T16:00:00.000Z","dateReserved":"2012-10-29T00:00:00.000Z","dateUpdated":"2024-08-06T21:14:16.402Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-10-20 16:55:05","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:bulbsecurity:smartphone_pentest_framework:0.1.2:*:*:*:*:*:*:*","matchCriteriaId":"FCE8CA0E-060D-42A2-80BE-C909AAF76DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:bulbsecurity:smartphone_pentest_framework:0.1.3:*:*:*:*:*:*:*","matchCriteriaId":"13A0E52A-E68C-4DBA-BD86-55DC3BD90FBE"},{"vulnerable":true,"criteria":"cpe:2.3:a:bulbsecurity:smartphone_pentest_framework:0.1.4:*:*:*:*:*:*:*","matchCriteriaId":"14C07A81-CA5F-4985-B53E-0C250EA3B229"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"5695","Ordinal":"1","Title":"CVE-2012-5695","CVE":"CVE-2012-5695","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"5695","Ordinal":"1","NoteData":"Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS message.","Type":"Description","Title":"CVE-2012-5695"},{"CveYear":"2012","CveId":"5695","Ordinal":"2","NoteData":"2014-10-20","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"5695","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}