NetSight
IP …
high7.5Public exploit code

CVE-2014-9566

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Ne…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager (NCM) before 7.3.2, IP Address Manager (IPAM) before 4.3, User Device Tracker (UDT) before 3.2, VoIP & Network Quality Manager (VNQM) before 4.2, Server & Application Manager (SAM) before 6.2, Web Performance Monitor (WPM) before 2.2, and possibly other Solarwinds products, allow remote authenticated users to execute arbitrary SQL commands via the (1) dir or (2) sort parameter to the (a) GetAccounts or (b) GetAccountGroups endpoint.

Affected products

VendorProductAffected versions
SolarwindsOrion Ip Address Manager
through 4.2
SolarwindsOrion Netflow Traffic Analyzer
through 4.0
SolarwindsOrion Network Configuration Manager
through 7.3.1
SolarwindsOrion Network Performance Monitor
through 11.4
SolarwindsOrion Server And Application Manager
through 6.1
SolarwindsOrion User Device Tracker
through 3.1
SolarwindsOrion Voip \& Network Quality Manager
through 4.1
SolarwindsOrion Web Performance Monitor
through 2.1

Weakness classification

CWE-89

References