SQL Injection in Cyberoam Cr500ing-Xp

CVE-2015-6811

SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to login.xml.

Vulnerability class: SQL Injection

EPSS: 0.017 (75.3th percentile) — read the EPSS interpretation.

Affected products

Cyberoam Cr500ing-xp
Cyberoam Cyberoamos — versions 10.6.2
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)