Scrutinizer < 9.5.2 d4d/statusFilter.php q Parameter SQL Injection

medium Nessus Plugin ID 61598

Language:

Synopsis

The remote web server hosts an application that is affected by a SQL injection vulnerability.

Description

The version of Scrutinizer installed on the remote web server is affected by a SQL injection vulnerability in the q parameter of the 'd4d/statusFilter.php' script.

An unauthenticated remote attacker can leverage this issue to manipulate database queries, leading to disclosure of sensitive information, attacks against the underlying database, and the like.

Solution

Upgrade to Dell Sonicwall Scrutinizer 9.5.2 or later.

Plugin Details

Severity: Medium

ID: 61598

File Name: scrutinizer_statusfilter_sqli.nasl

Version: 1.7

Type: remote

Family: CGI abuses

Published: 8/20/2012

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2012-2962

Vulnerability Information

CPE: cpe:/a:dell:sonicwall_scrutinizer

Required KB Items: www/scrutinizer_netflow_sflow_analyzer

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: No exploit is required

Patch Publication Date: 7/11/2012

Vulnerability Publication Date: 7/22/2012

Exploitable With

Metasploit (Dell SonicWALL (Plixer) Scrutinizer 9 SQL Injection)

Elliot (SonicWALL Scrutinizer 9.0.1 SQL Injection)

Reference Information

CVE: CVE-2012-2962

BID: 54625

CERT: 404051

Detections

Analytics