CVE-2012-3951

Sonicwall Scrutinizer < 9.0.1.19899 - SQL Injection

Title source: rule

Description

The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotewindows

https://www.exploit-db.com/exploits/20355

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by MC, Jonathan Claudius, Tanya Secker, sinn3r · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/mysql/scrutinizer_upload_exec.rb

View Code ZIP pw:eip

References (2)

[Third Party Advisory] http://www.plixer.com/Press-Releases/plixer-releases-9-5-2.html

[Exploit, Third Party Advisory] https://www.trustwave.com/spiderlabs/advisories/TWSL2012-014.txt

Scores

EPSS 0.7950

EPSS Percentile 99.1%

Classification

CWE

CWE-89

Status draft

Affected Products (1)

sonicwall/scrutinizer < 9.0.1.19899

Timeline

Published Jul 31, 2012

Tracked Since Feb 18, 2026