PT-2023-5601 · D Link · D-Link Dar-8000+1

Llixixioo · Published 2023-09-24 · Updated 2024-08-02 · CVE-2023-5152

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions D-Link DAR-7000 and DAR-8000 versions up to 20151231

Description A critical issue has been found in the /importexport.php file, where the manipulation of the sql argument leads to sql injection. This allows an attacker to execute arbitrary commands remotely. The exploit has been disclosed to the public. The issue affects products that are no longer supported by the maintainer and should be retired and replaced.

Recommendations For D-Link DAR-7000 and DAR-8000 versions up to 20151231, retire and replace the products as they are end-of-life and no longer supported by the maintainer. As a temporary workaround, consider restricting access to the /importexport.php file to minimize the risk of exploitation. Avoid using the sql argument in the affected file until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-06256

CVE-2023-5152

Affected Products

D-Link Dar-7000

D-Link Dar-8000

References · 9

• 🔥 https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_sql_%20importexport.md · Exploit
• https://bdu.fstec.ru/vul/2023-06256 · Security Note
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5152 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5152 · Security Note
• https://vuldb.com/?ctiid.240248 · Note
• https://t.me/cvenotify/88480 · Telegram Post
• https://vuldb.com/?id.240248 · Note
• https://t.me/cvenotify/60090 · Telegram Post