CVE-2014-4977

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php.

• CWE-89

• http://packetstormsecurity.com/files/127429/Dell-Sonicwall-Scrutinizer-11.01-Code-Execution-SQL-Injection.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/137098/Dell-SonicWALL-Scrutinizer-11.01-methodDetail-SQL-Injection.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2014/Jul/44Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/68495Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94439Third Party Advisory, VDB Entry
• https://gist.github.com/brandonprry/36b4b8df1cde279a9305Third Party Advisory
• https://gist.github.com/brandonprry/76741d9a0d4f518fe297Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/39836/Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/127429/Dell-Sonicwall-Scrutinizer-11.01-Code-Execution-SQL-Injection.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/137098/Dell-SonicWALL-Scrutinizer-11.01-methodDetail-SQL-Injection.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2014/Jul/44Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/68495Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94439Third Party Advisory, VDB Entry
• https://gist.github.com/brandonprry/36b4b8df1cde279a9305Third Party Advisory
• https://gist.github.com/brandonprry/76741d9a0d4f518fe297Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/39836/Third Party Advisory, VDB Entry

Published

Jul 16, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-4971Microsoft Windows XP SP3 does not validate addresses in cert…
• CVE-2014-4972Unrestricted file upload vulnerability in the Gravity Upload…
• CVE-2014-4973The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver…
• CVE-2014-4974The ESET Personal Firewall NDIS filter (EpFwNdis.sys) kernel…
• CVE-2014-4975Off-by-one error in the encodes function in pack.c in Ruby 1…
• CVE-2014-4976Dell SonicWall Scrutinizer 11.0.1 allows remote authenticate…
• CVE-2014-4978The rs_filter_graph function in librawstudio/rs-filter.c in …
• CVE-2014-4979Apple QuickTime allows remote attackers to execute arbitrary…
• CVE-2014-4980The /server/properties resource in Tenable Web UI before 2.3…
• CVE-2014-4981LPAR2RRD in 3.5 and earlier allows remote attackers to execu…9.8
• CVE-2014-4982LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on…9.8
• CVE-2014-4984Déjà Vu Crescendo Sales CRM has remote SQL Injection9.8