SQL Injection Vulnerabilities in Solarwinds Orion Platform and its Services
CVE-2014-9566

Currently unrated

Key Information:

Vendor
Solarwinds
Status
Orion Netflow Traffic Analyzer
Orion Web Performance Monitor
Orion Network Configuration Manager
Orion User Device Tracker
Vendor
CVE Published:
10 March 2015

Summary

The Solarwinds Orion Platform is vulnerable to multiple SQL injection flaws in its AccountManagement.asmx service, particularly on the Manage Accounts page. Remote authenticated users can exploit these weaknesses to execute arbitrary SQL commands, potentially compromising database integrity. Key affected components include Network Performance Monitor, NetFlow Traffic Analyzer, and several others within the Orion ecosystem, exposing a range of services to unauthorized data manipulation through specifically crafted requests.

References

https://github.com/rapid7/metasploit-framework/pull/4836
x_refsource_MISC
http://www.exploit-db.com/exploits/36262
exploitx_refsource_EXPLOIT-DB
http://osvdb.org/show/osvdb/118746
vdb-entryx_refsource_OSVDB

EPSS Score

75% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.