PT-2023-5607 · D Link · D-Link Dar-8000

Llixixioo · Published 2023-09-24 · Updated 2024-08-02 · CVE-2023-5153

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions D-Link DAR-8000 up to 20151231

Description A critical vulnerability was found in the D-Link DAR-8000, affecting an unknown part of the file /Tool/querysql.php. This issue leads to sql injection and can be initiated remotely. The exploit has been disclosed to the public. The vulnerability is related to the lack of protection of the SQL query structure, allowing an attacker to execute arbitrary commands remotely.

Recommendations For D-Link DAR-8000 up to 20151231, the recommended course of action is to retire and replace the product, as it is no longer supported by the maintainer. As a temporary workaround, consider restricting access to the /Tool/querysql.php file to minimize the risk of exploitation. Avoid using this file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-06262

CVE-2023-5153

Affected Products

D-Link Dar-8000

References · 8

• 🔥 https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_sql_%20querysql.md · Exploit
• https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5153 · Security Note
• https://bdu.fstec.ru/vul/2023-06262 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5153 · Vendor Advisory
• https://t.me/cvenotify/88481 · Telegram Post
• https://vuldb.com/?id.240249 · Note
• https://vuldb.com/?ctiid.240249 · Note