Description
Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve injected query results from a subsequent session request, enabling extraction of plaintext credentials and other database content with DBA-level privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kunshi Network Technology | Linknat VOS3000 | 2.1.1.5, 2.1.1.8, 2.1.2.0 | — |
| Kunshi Network Technology | Linknat VOS2009 | 2.1.1.5, 2.1.1.8, 2.1.2.0 | — |
References
- Archived WooYun Disclosure technical-description exploit
- Packet Storm Entry (137159) exploit
- Vendor Homepage product
- https://www.vulncheck.com/advisories/linknat-vos3000-vos2009-sql-injection-via-login-jsp third-party-advisory