CVE-2025-34059: falha de alta gravidade em Zhejiang Dahua Technology Co., Ltd.
Dahua Smart Cloud Gateway Registration Management Platform SQL Injection
Publicada em · Atualizada em
43Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck.
ssvc Actcvss 8.7epss 0.5%
da publicação à arma
Publicada no NVD1 de jul.
VulnCheck1 de jul.
probabilidade de exploração
0.5%top 59% das CVEs
exploração observada
simVulnCheck
An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclose sensitive information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Zhejiang Dahua Technology Co., Ltd. · Smart Cloud Gateway Registration Management PlatformReferências
https://pentest-tools.com/vulnerabilities-exploits/zhejiang-dahua-smart-cloud-gateway-registration-platform-sql-injection-cnvd-2024-38747_23762https://vulncheck.com/advisories/dahua-smart-cloud-gateway-sql-injectionhttps://www.cnblogs.com/LeouMaster/p/18509644https://www.cnvd.org.cn/flaw/show/CNVD-2024-38747https://www.dahuatech.com/