CVE-2012-5693 describes a critical command injection vulnerability in Bulb Security's Smartphone Pentest Framework (SPF) versions prior to 0.1.3. Attackers can execute arbitrary commands by injecting shell metacharacters into various parameters across multiple scripts within the frameworkgui/ directory. This vulnerability affects several scripts including remoteAttack.pl, guessPassword.pl, CSAttack.pl, SEAttack.pl, attach2agents.pl, and attachMobileModem.pl. The vulnerability carries a high CVSS score of 8.8, indicating a severe risk. It is remotely exploitable with low attack complexity and no user interaction required, allowing for complete compromise of confidentiality, integrity, and availability. The underlying weakness is a CWE-78, improper neutralization of special elements used in an OS command. Despite its high severity, there is no evidence of active exploitation, and it is not listed in CISA's KEV catalog. There are no known public exploits in Metasploit, Nuclei, or ExploitDB, and it has received minimal community discussion or media coverage, suggesting a low current threat landscape.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.1.3CPE matchmatch criteria | cpe:2.3:a:bulbsecurity:smartphone_pentest_framework:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.