CVE-2013-5945

published 2020-02-11

CVE-2013-5945: Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with…

Priority P2 74 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 allow remote attackers to execute arbitrary SQL commands via the password to (1) the login.authenticate function in share/lua/5.1/teamf1lualib/login.lua or (2) captivePortal.lua.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
dlink	dsr-1000_firmware	< 1.08b77	1.08b77
dlink	dsr-1000n_firmware	< 1.08b77	1.08b77
dlink	dsr-150_firmware	< 1.08b44	1.08b44
dlink	dsr-150n_firmware	< 1.05b64	1.05b64
dlink	dsr-250_firmware	< 1.08b44	1.08b44
dlink	dsr-250n_firmware	< 1.08b44	1.08b44
dlink	dsr-500_firmware	< 1.08b77	1.08b77
dlink	dsr-500n_firmware	< 1.08b77	1.08b77

Detection & IOCs extracted from sources · hover to see the quote

path share/lua/5.1/teamf1lualib/login.lua↗

path captivePortal.lua↗

command ' or 'a'='a↗

command telnetd -l /bin/sh↗

path /etc/passwd↗

• → Monitor HTTP login requests to D-Link DSR routers where the password field contains SQL injection payloads such as `' or 'a'='a` — this is the exact bypass string used in the exploit. ↗
• → Alert on post-authentication execution of `telnetd -l /bin/sh` on D-Link DSR devices, which indicates the attacker is spawning an unauthenticated shell via the privilege escalation stage (CVE-2013-5946). ↗
• → Detect session cookie capture immediately following a successful login response containing 'Logout' — the exploit harvests the session cookie for subsequent command execution. ↗
• → Monitor for writes to `/etc/passwd` on D-Link DSR devices (e.g., `echo -en '' > /etc/passwd`), which indicates the attacker is attempting to persist a backdoor credential. ↗
• → The vulnerable code paths are `login.authenticate` in `share/lua/5.1/teamf1lualib/login.lua` and `captivePortal.lua`; inspect HTTP POST bodies targeting these endpoints for unsanitized password parameters. ↗

• · Exploitation requires the `admin` account to not already have an active session; the exploit explicitly fails if 'User already logged in' is returned, meaning concurrent admin sessions block the attack. ↗
• · Affected firmware versions are: DSR-150/DSR-250/DSR-250N/DSR-500/DSR-500N/DSR-1000/DSR-1000N before 1.08B44 (or 1.05B64 / 1.08B77 depending on model); devices patched to or beyond these versions are not vulnerable. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89