{"id":"CVE-2023-5151","published":"2023-09-25T01:31:05Z","modified":"2024-09-24T19:20:42Z","title":"D-Link DAR-8000 autheditpwd.php sql injection","vendor":"D-Link","product":"DAR-8000","tier":"core","eol":null,"affectedVersions":[{"vendor":"D-Link","product":"DAR-8000","versions":["20151231"]}],"description":{"text":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknown functionality of the file /autheditpwd.php. The manipulation of the argument hid_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240247. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.","provenance":"source","from":"CVE.org"},"summary":{"text":"The D-Link DAR-8000 product contains a SQL injection flaw in the autheditpwd.php file, where the hid_id argument is not properly sanitised. An remote attacker who has low-privilege authentication can exploit this over the network without any user interaction to run arbitrary SQL commands against the backend database, affecting confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:30Z"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.80571,"percentile":0.99623,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://vuldb.com/?id.240247","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.240247","tags":["signature","permissions-required"]},{"url":"https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_sql_%20autheditpwd.md","tags":["exploit"]},{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10354","tags":["related"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-57489","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57489","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://github.com/llixixi/cve/blob/main/D-LINK-DAR-8000-10_sql_%20autheditpwd.md"],"flow":[],"timeline":[{"date":"2023-09-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-5151","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":29.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9962"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.41,"detail":"base score 6.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}