Exploitation Summary
EIP tracks 2 public exploits for CVE-2014-4977.
PoCs published by Metasploit, bperry, sinn3r, including Metasploit module exploits/multi/http/sonicwall_scrutinizer_methoddetail_sqli.
AI-analyzed exploit summary This Metasploit module exploits a SQL injection vulnerability in Dell SonicWALL Scrutinizer 11.01 via the methodDetail parameter in exporters.php, allowing arbitrary file write and remote code execution. It uses default admin credentials for authentication and supports both Windows and Linux targets.
Description
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php.
Exploits (2)
This Metasploit module exploits a SQL injection vulnerability in Dell SonicWALL Scrutinizer 11.01 via the methodDetail parameter in exporters.php, allowing arbitrary file write and remote code execution. It uses default admin credentials for authentication and supports both Windows and Linux targets.
This Metasploit module exploits a SQL injection vulnerability in Dell SonicWALL Scrutinizer 11.01 via the methodDetail parameter in exporters.php, allowing arbitrary file write and remote code execution. It uses default credentials (admin:admin) for authentication and supports both Windows and Linux targets.