CVE-2023-6581 MEDIUM

CVE-2023-6581: D-Link DAR-7000 workidajax.php sql injection

Vendor D-Link

Product DAR-7000

Weakness CWE-89 · SQLi

Published December 7, 2023

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

5.5/10

Attack vector Adjacent

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability has been found in D-Link DAR-7000 up to 20231126 and classified as critical. This vulnerability affects unknown code of the file /user/inc/workidajax.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-247162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

December 7, 2023 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-6581 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2023-0895 WP Coder – add custom html, css and js code <= 2.5.3 - Authenticated (Admin+) SQL Injection CVE-2025-32307 WordPress Chameleon HTML5 Audio Player With/Without Playlist plugin <= 3.5.6 - SQL Injection Vulnerability CVE-2025-0201 code-projects Point of Sales and Inventory Management System update_account.php sql injection CVE-2026-3969 FeMiner wms Basic Organizational Structure depart_add_bg.php sql injection CVE-2024-9039 SourceCodester Best House Rental Management System ajax.php sql injection