Sign In
Advisories

Dahua Smart Cloud Gateway SQL Injection

Go Back
severity
high
date
Affecting

  • An affected version range remains undefined

CVE type
CWE-89: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS
8.7
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclose sensitive information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.