SonicWall GMS and Analytics 身份认证绕过漏洞(CVE-2023-34124)

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-34124
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
• https://www.cve.org/CVERecord?id=CVE-2023-34124
• https://avd.aliyun.com/detail?id=AVD-2023-34124
• https://www.rapid7.com/db/vulnerabilities/sonicwall-gms-cve-2023-34124/
• https://cn-sec.com/archives/1873614.html
• https://cve.imfht.com/detail/CVE-2023-34124?lang=en
• https://developer.cloud.tencent.com/article/2324056
• https://github.com/advisories/GHSA-xc4x-f462-g6p7
• https://www.rapid7.com/blog/post/2023/07/13/etr-sonicwall-recommends-urgent-patching-for-gms-and-analytics-cves/

Related Vulnerabilities

• WordPress Plugin NotificationX /wp-json/notificationx/v1/analytics SQL 注入漏洞 （CVE-2024-1698）
• PoCCVE-2017-14651: WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting
• PoCCVE-2017-18556: Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting
• PoCCVE-2019-7481: SonicWall SRA 4600 VPN - SQL Injection
• PoCCVE-2021-20031: SonicWall SonicOS 7.0 - Open Redirect
• PoCCVE-2021-20038: SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution
• PoCCVE-2022-24637: Open Web Analytics 1.7.3 - Remote Code Execution
• PoCCVE-2022-43769: Hitachi Pentaho Business Analytics Server - Remote Code Execution
• PoCCVE-2023-0126: SonicWall SMA1000 LFI
• PoCCVE-2023-0630: Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection
• PoCCVE-2023-34124: SonicWall GMS and Analytics Web Services - Shell Injection
• PoCCVE-2024-0250: Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect