Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2018-12464

CriticalPublished

Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway

Published: Jun 29, 2018
Updated: Sep 17, 2024
Assigning CNA: microfocus
Evidence observed: Jul 24, 2018

Primary CVSS

10.0/ 10Critical

nvd · CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS probability estimate

80.7%

High · next 30 days

Percentile: 99.6%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5).

Sources

Micro Focus Secure Messaging Gateway (SMG) < 471 - Remote Code Execution (Metasploit)Exploit
Mehmet Ince · php · Jul 24, 2018

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.