NetSight
IP …
critical9.8Public exploit code

CVE-2013-5945

Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmwar…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 allow remote attackers to execute arbitrary SQL commands via the password to (1) the login.authenticate function in share/lua/5.1/teamf1lualib/login.lua or (2) captivePortal.lua.

Affected products

VendorProductAffected versions
DlinkDsr-150 Firmware
before 1.08b44
DlinkDsr-150n Firmware
before 1.05b64
DlinkDsr-250 Firmware
before 1.08b44
DlinkDsr-250n Firmware
before 1.08b44
DlinkDsr-500 Firmware
before 1.08b77
DlinkDsr-500n Firmware
before 1.08b77
DlinkDsr-1000 Firmware
before 1.08b77
DlinkDsr-1000n Firmware
before 1.08b77

Weakness classification

CWE-89

References