CVE-2012-4949

CVE-2012-4949 is an SQL injection vulnerability in ESRI ArcGIS 10.1 where the where parameter in a REST service query URI can be exploited by remote authenticated users to execute arbitrary SQL. The root cause is inadequate sanitization of SQL commands in the where clause, enabling a subset of SQ...

CVE-2012-4949: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service...