Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- SonicWall / Analytics2.5.0.4-R7 and earlier versions – 2.5.0.4-R7 and earlier versions
- SonicWall / GMS9.3.2-SP1 and earlier versions – 9.3.2-SP1 and earlier versions
Exploits & PoCs
- nucleiSonicWall GMS and Analytics - SQL Injectionby theamanrawat