SolarWinds Orion Multiple SQLi Vulnerabilities

high Nessus Plugin ID 83817

Language:

Synopsis

The remote host is affected by multiple SQL injection vulnerabilities.

Description

The remote host is running a version of SolarWinds Orion Core that is affected by multiple blind SQL injection vulnerabilities in the 'AccountManagement.asmx' script. A remote attacker, after being authenticated using the built-in default 'Guest' account, can exploit these vulnerabilities to execute arbitrary SQL commands. Note that the 'Guest' account needs to be enabled for exploitation of these vulnerabilities to occur.

Solution

Contact the vendor for a software version containing a patched Orion Core.

Plugin Details

Severity: High

ID: 83817

File Name: solarwinds_orion_multiple_sqli.nasl

Version: 1.6

Type: remote

Family: CGI abuses

Published: 5/27/2015

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2014-9566

Vulnerability Information

CPE: cpe:/a:solarwinds:orion_network_performance_monitor, cpe:/a:solarwinds:orion_netflow_traffic_analyzer, cpe:/a:solarwinds:orion_network_configuration_manager, cpe:/a:solarwinds:orion_ip_address_manager, cpe:/a:solarwinds:orion_user_device_tracker, cpe:/a:solarwinds:orion_voip_%26_network_quality_manager, cpe:/a:solarwinds:orion_server_and_application_manager, cpe:/a:solarwinds:orion_web_performance_monitor

Required KB Items: installed_sw/SolarWinds Orion Core

Excluded KB Items: global_settings/supplied_logins_only

Exploit Available: true

Exploit Ease: No exploit is required

Patch Publication Date: 2/24/2015

Vulnerability Publication Date: 2/24/2015

Reference Information

CVE: CVE-2014-9566

BID: 72876

Detections

Analytics