CVE-2012-1017

CVE-2012-1017 describes multiple SQL injection vulnerabilities in Basic Analysis and Security Engine (BASE) version 1.4.5, specifically within the base_qry_main.php script. These flaws allow unauthenticated remote attackers to execute arbitrary SQL commands by manipulating the ip_addr[0][1], ip_addr[0][2], or ip_addr[0][9] parameters. With a CVSS score of 7.5, this vulnerability is considered highly severe due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog and lacking active exploitation or significant community discussion, public exploit code is available via ExploitDB, indicating a clear path for exploitation.