CVE-2014-4977

Related Files

Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection

Posted May 17, 2016

Authored by sinn3r, Brandon Perry | Site metasploit.com

This Metasploit module exploits a vulnerability found in Dell SonicWALL Scrutinizer. The methodDetail parameter in exporters.php allows an attacker to write arbitrary files to the file system with an SQL Injection attack, and gain remote code execution under the context of SYSTEM for Windows, or as Apache for Linux. Authentication is required to exploit this vulnerability, but this module uses the default admin:admin credential.

tags | exploit, remote, arbitrary, php, code execution, sql injection

systems | linux, windows

advisories | CVE-2014-4977

SHA-256 | 46eef5e2e82adcace1eb86cca34fa1691dfc435af8857a0821e91b120976f5fc

Download | Favorite | View