（CVE-2023-34133）SonicWall GMS和Analytics SQL注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-34133
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
• https://www.rapid7.com/db/vulnerabilities/sonicwall-gms-cve-2023-34133/
• https://www.fox-it.com/be-en/technical-advisory-sonicwall-global-management-system-gms-analytics-multiple-critical-vulnerabilities/
• https://github.com/advisories/GHSA-gj6c-q4g4-xwj5
• https://www.rapid7.com/blog/post/2023/07/13/etr-sonicwall-recommends-urgent-patching-for-gms-and-analytics-cves/
• https://cn-sec.com/archives/1873614.html
• https://s4e.io/tools/sonicwall-gms-and-analytics-sqli-cve-2023-34133
• https://github.com/runZeroInc/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34133.yaml
• https://radar.offseq.com/threat/cve-2023-34133-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-in-sonicwall-gms-bf4fe3

Related Vulnerabilities

• WordPress Plugin NotificationX /wp-json/notificationx/v1/analytics SQL 注入漏洞 （CVE-2024-1698）
• PoCCVE-2017-14651: WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting
• PoCCVE-2017-18556: Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting
• PoCCVE-2019-7481: SonicWall SRA 4600 VPN - SQL Injection
• PoCCVE-2021-20031: SonicWall SonicOS 7.0 - Open Redirect
• PoCCVE-2021-20038: SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution
• PoCCVE-2022-24637: Open Web Analytics 1.7.3 - Remote Code Execution
• PoCCVE-2022-43769: Hitachi Pentaho Business Analytics Server - Remote Code Execution
• PoCCVE-2023-0126: SonicWall SMA1000 LFI
• PoCCVE-2023-0630: Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection
• PoCCVE-2023-34124: SonicWall GMS and Analytics Web Services - Shell Injection
• PoCCVE-2024-0250: Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect