CVE-2013-5945
CRITICALD-Link DSR Series Firmware - SQL Injection via Login Password Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-5945. PoCs published by 0_o.
AI-analyzed exploit summary This exploit leverages SQL injection (CVE-2013-5945) for authentication bypass and command injection (CVE-2013-5946) to achieve root shell access on vulnerable D-Link DSR routers. It automates login, privilege escalation, and telnetd manipulation for remote access.
Description
Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 allow remote attackers to execute arbitrary SQL commands via the password to (1) the login.authenticate function in share/lua/5.1/teamf1lualib/login.lua or (2) captivePortal.lua.
Exploits (1)
This exploit leverages SQL injection (CVE-2013-5945) for authentication bypass and command injection (CVE-2013-5946) to achieve root shell access on vulnerable D-Link DSR routers. It automates login, privilege escalation, and telnetd manipulation for remote access.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H