Published: 16/07/2014 Updated: 12/03/2018

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

VMScore: 655

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sonicwall scrutinizer 11.0.1

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper include Msf::Exploit::EXE WINDOW ...

CWE-89 http://seclists.org/fulldisclosure/2014/Jul/44 https://gist.github.com/brandonprry/36b4b8df1cde279a9305 http://www.securityfocus.com/bid/68495 https://gist.github.com/brandonprry/76741d9a0d4f518fe297 http://packetstormsecurity.com/files/127429/Dell-Sonicwall-Scrutinizer-11.01-Code-Execution-SQL-Injection.html http://packetstormsecurity.com/files/137098/Dell-SonicWALL-Scrutinizer-11.01-methodDetail-SQL-Injection.html https://www.exploit-db.com/exploits/39836/https://exchange.xforce.ibmcloud.com/vulnerabilities/94439 https://nvd.nist.gov https://www.exploit-db.com/exploits/39836/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-4977

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect