PT-2023-6898 · D Link · D-Link Dar-7000

Flyyue2001 · Publicado 2023-10-26 · Atualizado 2024-01-02 · CVE-2023-42406

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DAR-7000 version V31R02B1413C

Description The issue is related to a SQL injection vulnerability in the editrole.php component, which can be exploited by a remote attacker to obtain sensitive information and execute arbitrary code. This is due to the lack of protection measures for the SQL query structure.

Recommendations For D-Link DAR-7000 version V31R02B1413C, consider disabling the editrole.php component until a patch is available to prevent exploitation. Restrict access to this component to minimize the risk of arbitrary code execution. Avoid using the vulnerable component for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-07916

CVE-2023-42406

Produtos afetados

D-Link Dar-7000

Referências · 11

• 🔥 https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000_sql_:sysmanage:editrole.php.md · Exploit
• 🔥 https://github.com/1dreamGN/CVE/blob/main/CVE-2023-42406.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-42406 · Nota de Segurança
• https://t.me/cibsecurity/73029 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-42406 · Aviso do Fabricante
• https://safe-surf.ru/upload/VULN-new/VULN.2023-11-01.1.pdf · Nota de Segurança
• https://twitter.com/CVEnew/status/1717660737508700465 · Publicação no Twitter
• https://twitter.com/PentestingN/status/1742073651430662174 · Publicação no Twitter
• https://twitter.com/ksg93rd/status/1742216028963123364 · Publicação no Twitter
• https://t.me/cybersecuritytechnologies/9702 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-07916 · Nota de Segurança