CVE-2012-4673: SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attacke...

Security readout for executives and security teams

CVE-2012-4673 describes a SQL injection issue in NeoInvoice. A remote attacker might manipulate an invoice listing sort parameter to run unintended database queries. The public record does not provide a CVSS score, affected versions, or confirmed exploitation, so urgency depends on whether the organization still runs NeoInvoice. Exposure is likely limited to organizations running NeoInvoice, especially internet-accessible invoice functionality. The supplied sources do not identify affected versions or deployment conditions, so teams must verify against their own software inventory and code lineage. Prioritize inventory first. This is an old, potentially serious database flaw, but the public evidence lacks affected versions, scoring, and exploitation confirmation. Escalate if NeoInvoice is still reachable or stores sensitive billing data. Mitigation focus: Identify whether NeoInvoice is present in production, staging, or archived systems.; Review the referenced GitHub commit and project issue for applicable remediation context.; Apply the project-provided fixed code or upgrade path if it matches your deployment..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.