Description
An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclose sensitive information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Zhejiang Dahua Technology Co., Ltd. Smart Cloud Gateway Registration Management Platform
Default version status: unknown
0affected
References
- https://www.cnvd.org.cn/flaw/show/CNVD-2024-38747 ↗
- https://www.cnblogs.com/LeouMaster/p/18509644 ↗
- https://www.dahuatech.com/ ↗
- https://pentest-tools.com/vulnerabilities-exploits/zhejiang-dahua-smart-cloud-gateway-registration-platform-sql-injection-cnvd-2024-38747_23762 ↗
- https://vulncheck.com/advisories/dahua-smart-cloud-gateway-sql-injection ↗