SQL Injection Vulnerabilities in Solarwinds Orion Platform and its Services
CVE-2014-9566

Currently unrated

Key Information:

Vendor: Solarwinds
Status: Orion Netflow Traffic Analyzer; Orion Web Performance Monitor; Orion Network Configuration Manager; Orion User Device Tracker
Vendor: CVE Published:; 10 March 2015

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 77%

What is CVE-2014-9566?

The Solarwinds Orion Platform is vulnerable to multiple SQL injection flaws in its AccountManagement.asmx service, particularly on the Manage Accounts page. Remote authenticated users can exploit these weaknesses to execute arbitrary SQL commands, potentially compromising database integrity. Key affected components include Network Performance Monitor, NetFlow Traffic Analyzer, and several others within the Orion ecosystem, exposing a range of services to unauthorized data manipulation through specifically crafted requests.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2014-9566 - Proof of Concept