CVE-2012-0939

CVE-2012-0939 describes multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier versions. An authenticated attacker with Requirement view permission can exploit these flaws by manipulating the req_spec_id parameter in specific PHP scripts (reqSpecAnalyse.php, reqSpecPrint.php, or reqSpecView.php) to execute arbitrary SQL commands. This vulnerability carries a CVSS score of 6.5, indicating a medium severity risk due to its network-based attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.