CVE-2014-4977: SQL Injection
First published: Wed Jul 16 2014(Updated: )
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SonicWALL Scrutinizer | =11.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/127429/Dell-Sonicwall-Scrutinizer-11.01-Code-Execution-SQL-Injection.html
- http://packetstormsecurity.com/files/137098/Dell-SonicWALL-Scrutinizer-11.01-methodDetail-SQL-Injection.html
- http://seclists.org/fulldisclosure/2014/Jul/44
- http://www.securityfocus.com/bid/68495
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94439
- https://gist.github.com/brandonprry/36b4b8df1cde279a9305
- https://gist.github.com/brandonprry/76741d9a0d4f518fe297
- https://www.exploit-db.com/exploits/39836/
Frequently Asked Questions
What is the severity of CVE-2014-4977?
CVE-2014-4977 is considered high severity due to its ability to allow remote authenticated users to execute arbitrary SQL commands.
How do I fix CVE-2014-4977?
To fix CVE-2014-4977, upgrade Dell SonicWall Scrutinizer to a patched version that addresses these SQL injection vulnerabilities.
Who is affected by CVE-2014-4977?
CVE-2014-4977 affects authenticated users of Dell SonicWall Scrutinizer version 11.0.1.
What kind of attack can be performed using CVE-2014-4977?
Using CVE-2014-4977, an attacker can exploit SQL injection vulnerabilities to execute arbitrary SQL commands on the database.
What components of Dell SonicWall Scrutinizer are vulnerable in CVE-2014-4977?
CVE-2014-4977 affects the create new user request and the changeUnit function in Dell SonicWall Scrutinizer.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- vendor/sonicwall
- canonical/sonicwall scrutinizer
- version/sonicwall scrutinizer/11.0.1