Vulnerability record · CVE-2012-2576 · published 20 December 2017
CVE-2012-2576: SolarWinds Storage Manager LoginServlet SQL injection
Solarwinds · Backup Profiler
The LoginServlet page in SolarWinds Storage Manager, Storage Profiler and Backup Profiler before 5.1.2 fails to sanitize the loginName field, allowing SQL command injection. Because the flaw sits in the login path, it is reachable without authentication and can expose or alter the backend database.
Description
SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 3.0 score is 9.8 with no authentication or user interaction required, and public exploit code plus a high EPSS score make exploitation likely.
What it is
The LoginServlet page in SolarWinds Storage Manager, Storage Profiler and Backup Profiler before 5.1.2 fails to sanitize the loginName field, allowing SQL command injection. Because the flaw sits in the login path, it is reachable without authentication and can expose or alter the backend database.
Impact
An unauthenticated attacker can execute arbitrary SQL against the application database, potentially reading credentials and sensitive data or modifying stored records. The CVSS 3.0 vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network through the LoginServlet login request by supplying a crafted loginName value; the CVSS vector shows no privileges required and no user interaction. No other interface is described in the record.
Exploitation
Public exploit code exists in Exploit-DB (18818, 18833) and EPSS is 0.59413 (99th percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.
What to do
- Upgrade SolarWinds Storage Manager, Storage Profiler and Backup Profiler to 5.1.2 or later per the vendor advisory.
- If upgrade is not immediately possible, restrict network access to the LoginServlet/management interface to trusted hosts only.
- Use parameterized queries or strict input validation on the loginName field in any interim code fix.
- Review database accounts used by the application for least privilege and rotate credentials if compromise is suspected.
Detection
- Inspect web and application logs for SQL metacharacters (quotes, UNION, OR 1=1, comment markers) in loginName parameters on LoginServlet requests.
- Alert on database errors or unusual SQL statements originating from the application server.
- Monitor for repeated failed or malformed login attempts against the SolarWinds management interface from single sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.exploit-db.com/exploits/18818 | ExploitThird Party AdvisoryVDB Entry |
| http://www.exploit-db.com/exploits/18833 | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/51639 | Third Party AdvisoryVDB Entry |
| http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/vulnerability.htm | Vendor Advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/72680 | Third Party AdvisoryVDB Entry |
| http://www.exploit-db.com/exploits/18818 | ExploitThird Party AdvisoryVDB Entry |
| http://www.exploit-db.com/exploits/18833 | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/51639 | Third Party AdvisoryVDB Entry |
| http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/vulnerability.htm | Vendor Advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/72680 | Third Party AdvisoryVDB Entry |
Track CVE-2012-2576 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-2576), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
