CVE-2012-4240
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90...
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.
- Record
CVE-2012-4240- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.
- Record
CVE-2012-4240- Updated
- 2026-11-02
EUVDEUVD-2012-4184 No score
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.
- Record
EUVD-2012-4184- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7gpq-4vwj-j795 No score
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90...
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.
- Record
GHSA-7gpq-4vwj-j795- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Group Office Calendar - '/calendar/json.php' SQL Injection | 2012-09-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-4240 is a medium vulnerability (CVSS 6.5) in Group-office Groupoffice, published September 11, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. No source names a fixed version.
References
exploit-db.com/exploits/21056
reactionpenetrationtesting.co.uk/group-office-sqli.html
exchange.xforce.ibmcloud.com/vulnerabilities/78253
securityfocus.com/bid/55383
archives.neohapsis.com/archives/bugtraq/2012-09/0011.html
osvdb.org/85171
nvd.nist.gov/vuln/detail/CVE-2012-4240
github.com/advisories/GHSA-7gpq-4vwj-j795