cbcvebase.
CVE-2019-13462
published 2019-08-12

CVE-2019-13462: Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.

PriorityP185critical9.1CVSS 3.0
AVNACLPRNUINSUCHIHAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
11.31%
95.4th percentile
Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.

Affected

1 ranges
VendorProductVersion rangeFixed in
lansweeperlansweeper< 7.1.117.47.1.117.4

Detection & IOCsextracted from sources · hover to see the quote

url/WidgetHandler.ashx?MethodName=Sort&ID=1&row=1&column=%28SELECT%20CONCAT%28CONCAT%28CHAR%28126%29%2C%28SELECT%20SUBSTRING%28%28ISNULL%28CAST%28db_name%28%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C1024%29%29%29%2CCHAR%28126%29%29%29↗
path/WidgetHandler.ashx↗
  • →Exploit targets the unauthenticated GET endpoint /WidgetHandler.ashx with MethodName=Sort and a SQL injection payload in the 'column' parameter using CONCAT/CHAR/SUBSTRING to exfiltrate db_name(). ↗
  • →Successful exploitation returns HTTP 500 with Content-Type: text/plain and the response body contains the tilde-delimited database name string '~lansweeperdb~'. ↗
  • →Shodan, FOFA, and Google dorks can be used to identify exposed Lansweeper login pages as potential targets: Shodan 'http.title:"lansweeper - login"', FOFA 'title="lansweeper - login"', Google 'intitle:"lansweeper - login"'. ↗
  • ·The vulnerability affects Lansweeper versions before 7.1.117.4 only; patched versions are not vulnerable. ↗

CVSS provenance

nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vulncheck9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.