CVE-2014-4977
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 74.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 74.93% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- sonicwall/scrutinizer
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/127429/Dell-Sonicwall-Scrutinizer-11.01-Code-Execution-SQL-Injection.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/137098/Dell-SonicWALL-Scrutinizer-11.01-methodDetail-SQL-Injection.htmlThird Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2014/Jul/44Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/68495Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94439Third Party Advisory, VDB Entry
- https://gist.github.com/brandonprry/36b4b8df1cde279a9305Third Party Advisory
- https://gist.github.com/brandonprry/76741d9a0d4f518fe297Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/39836/Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/127429/Dell-Sonicwall-Scrutinizer-11.01-Code-Execution-SQL-Injection.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/137098/Dell-SonicWALL-Scrutinizer-11.01-methodDetail-SQL-Injection.htmlThird Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2014/Jul/44Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/68495Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94439Third Party Advisory, VDB Entry
- https://gist.github.com/brandonprry/36b4b8df1cde279a9305Third Party Advisory
- https://gist.github.com/brandonprry/76741d9a0d4f518fe297Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/39836/Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.