DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability
Medium
November 19, 2009
Digital Defense, Inc. Vulnerability Research Team
Credit: Rob Kraus, Chris Graham and r@b13$
The login page of the F2L-3000 version 4.0.0 is vulnerable to SQL Injection.
Exploitation of the vulnerability may allow attackers to bypass authentication and
access sensitive information stored on the device.
A patch is not available at this time. Possible workarounds include disabling the
vulnerable service, or limiting access to a set of trusted IP addresses.
F2L-3000 version 4.0.0 is the only platform that has been manually tested. Earlier
versions and other, similar models may also be vulnerable as the platform is sold
in various configurations.
Vendor Website: http://www.files2links.com/