CVE-2012-2171

CVE-2012-2171 describes a SQL injection vulnerability in the Storage Manager Profiler of IBM System Storage DS Storage Manager, affecting versions prior to 10.83.xx.18 on DS Series devices. An authenticated attacker can exploit this flaw by manipulating the "selectedModuleOnly" parameter in a "state_viewmodulelog" action to the ModuleServlet URI, enabling the execution of arbitrary SQL commands. With a CVSS score of 6.5, this vulnerability is moderately severe, requiring authentication but having low attack complexity, potentially leading to compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog and lacking Metasploit or Nuclei modules, an ExploitDB entry (EDB-19321) exists, indicating public exploit code, though there is no evidence of active exploitation or significant community discussion.