CVE-2018-25333
HIGHNordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25333. PoCs published by t4rkd3vilz.
AI-analyzed exploit summary This is a functional SQL injection exploit targeting Nordex N149/4.0-4.5 Wind Turbine Web Server. The PoC demonstrates a time-based blind SQL injection via the login parameter, leveraging error-based techniques to trigger duplicate key errors and extract data.
Description
Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloads in the login field to extract sensitive database information and bypass authentication mechanisms.
Exploits (1)
This is a functional SQL injection exploit targeting Nordex N149/4.0-4.5 Wind Turbine Web Server. The PoC demonstrates a time-based blind SQL injection via the login parameter, leveraging error-based techniques to trigger duplicate key errors and extract data.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N