CVE-2019-13373

🗓️ 06 Jul 2019 22:54:48Reported by mitreType

cve🔗 web.nvd.nist.gov👁 281 Views🌐 WEB

An issue discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows for arbitrary SQL execution via /web/Public/Conn.php parameter dbSQL

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2019-13373	7 Jul 201901:59	–	circl
CNVD	D-Link Central WiFi Manager (CWM-100) Arbitrary SQL Command Query Vulnerability	8 Jul 201900:00	–	cnvd
Check Point Advisories	D-Link Central WiFiManager CWM-100 SQL Injection (CVE-2019-13373)	14 Nov 202200:00	–	checkpoint_advisories
Cvelist	CVE-2019-13373	6 Jul 201922:54	–	cvelist
Metasploit	D-Link Central WiFiManager SQL injection	15 Feb 202117:42	–	metasploit
NVD	CVE-2019-13373	6 Jul 201923:15	–	nvd
Packet Storm	D-Link Central WiFiManager SQL Injection	31 Aug 202400:00	–	packetstorm
Prion	Input validation	6 Jul 201923:15	–	prion
Rapid7 Blog	Metasploit Wrap-Up	19 Feb 202117:55	–	rapid7blog
RedhatCVE	CVE-2019-13373	22 May 202508:04	–	redhatcve

NVD

Node

dlink central_wifimanagerMatch1.03

AND

microsoft windowsMatch-

Source	Link
supportannouncement	www.supportannouncement.us.dlink.com/announcement/publication.aspx
github	www.github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md
unh3x	www.unh3x.github.io/2019/02/21/D-link-%28CWM-100%29-Multiple-Vulnerabilities/

Parameter	Position	Path	Description	CWE
dbSQL	request body	web/Public/Conn.php	SQL injection via Conn.php dbSQL parameter allowing arbitrary SQL execution.	CWE-89
dbAction	request body	web/Public/Conn.php	SQL injection via Conn.php dbSQL parameter allowing arbitrary SQL execution.	CWE-89

21 Nov 2024 04:24Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 39.8

EPSS0.90075

CWE-89