Executive brief
Cyclope Employee Surveillance Solution, a software used by organizations to monitor employee computer activity and productivity, contains a critical security flaw in its login system. An unauthenticated attacker can bypass security controls to run malicious commands on the server. This allows for complete takeover of the monitoring system, potentially exposing sensitive employee data or providing a foothold for further attacks on the corporate network.
Technical details
A SQL injection vulnerability exists in the 'username' parameter of the 'auth-login' POST request in Cyclope Employee Surveillance Solution versions 6.x. The application fails to properly sanitize user input before including it in a database query. An unauthenticated attacker can exploit this by injecting arbitrary SQL commands, specifically using the 'INTO OUTFILE' command to write a malicious PHP shell to the web root. Because the application typically runs with high privileges on Windows, this results in remote code execution under the SYSTEM user context. Metasploit modules and public exploits are available for this vulnerability.
Affected products
- Cyclope Employee Surveillance Solution 6.x
Timeline
- 2012-08-08: disclosed: Initial discovery and disclosure by loneferret
- 2012-08-15: other: Metasploit module released
- 2025-08-08: advisory: CVE-2012-10047 assigned/updated in NVD
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/cyclope_ess_sqli.rb
- https://www.cyclope-series.com/
- https://www.exploit-db.com/exploits/20393
- https://www.exploit-db.com/exploits/20501
- https://www.vulncheck.com/advisories/cyclope-employee-surveillance-solution-sql-injection