CVE-2023-5151

What it actually does

The flaw is an authenticated remote SQL injection in the unsupported D-Link DAR-8000 administrative endpoint /autheditpwd.php. The hid_id parameter is not safely handled before being used in a database query, allowing a logged-in attacker or an attacker with valid low-privilege access to alter the query logic. Successful exploitation can expose database contents, modify administrative data such as passwords or configuration, and potentially disrupt device operation depending on database permissions and application behavior.

Why it matters to the business

Because the affected product is end-of-life and public exploit details are available, internet-exposed or poorly segmented devices present a high operational risk even though this issue is not currently listed in CISA KEV. A compromised device could lead to credential theft, unauthorized configuration changes, loss of availability, and use of the appliance as a foothold for further network intrusion. The high EPSS score indicates a materially elevated likelihood of exploitation in the wild, and unsupported devices should be treated as replacement candidates rather than normal patch candidates.

How an attack unfolds

An attacker first identifies a reachable D-Link DAR-8000 management interface and obtains or reuses valid credentials, since the vulnerability requires privileges. After authenticating, the attacker sends crafted requests to /autheditpwd.php with malicious input in the hid_id parameter. The application incorporates that input into a SQL query without proper parameterization, causing the database to execute attacker-influenced logic. The attacker can then enumerate or extract sensitive records, alter password or configuration data, and potentially impair the appliance by corrupting data or issuing expensive database operations. Public exploit availability lowers the skill and time required, making exposed legacy deployments especially risky.

How to fix it

Retire and replace affected D-Link DAR-8000 appliances because the vendor has confirmed the product is end-of-life and unsupported. Do not rely on a future vendor fix for the DAR-8000 line. Until replacement is complete, remove management interfaces from the internet, restrict access to dedicated administrative networks and VPNs, enforce strong unique credentials, disable unused accounts, and monitor all administrative access. Where this record is being tracked through Debian package advisories, ensure packages are updated to the listed fixed versions: webkit2gtk on Debian 11 to 2.42.5-1~deb11u1, webkit2gtk on Debian 12 to 2.42.5-1~deb12u1, webkit2gtk on Debian 13 to 2.42.5-1, and wpewebkit on Debian 13 to 2.42.5-1; validate product applicability because the vulnerability description identifies D-Link DAR-8000 as the affected appliance.

How to confirm the fix worked

Confirm whether any D-Link DAR-8000 appliances remain in service, especially versions up to 20151231, and verify that management interfaces are not externally reachable. Validate that the device has been decommissioned or replaced; if temporary mitigation is used, confirm access controls block untrusted networks from reaching /autheditpwd.php. Review package inventories where Debian advisories are in scope and confirm webkit2gtk/wpewebkit versions meet or exceed the listed fixed versions. Use authenticated configuration review, vulnerability scanning, and web/proxy log checks to verify that requests to /autheditpwd.php are no longer exposed to unauthorized sources.

Typical attack path

1. Discover a D-Link DAR-8000 management interface through scanning, asset inventory leaks, or access to an internal network.
2. Authenticate using valid, default, reused, phished, or previously compromised credentials.
3. Send crafted HTTP requests to /autheditpwd.php that manipulate the hid_id parameter.
4. Use SQL injection behavior to confirm database interaction and enumerate accessible tables or records.
5. Extract sensitive data or modify administrative values such as credentials and configuration.
6. Use the compromised appliance as a persistence point, pivot path, or staging system for further activity.

How to detect it

Review HTTP access logs, reverse proxy logs, WAF logs, VPN logs, firewall logs, and device administrative audit logs for requests to /autheditpwd.php, especially where the hid_id parameter contains SQL keywords, quotes, comments, encoded characters, or time-delay functions. Correlate suspicious requests with successful logins, new or modified administrator accounts, password changes, configuration changes, unexpected device reboots, and outbound connections from the appliance after the request. Look for repeated requests with different hid_id values, HTTP 500 errors, database error messages, and unusually long response times that may indicate blind or time-based SQL injection attempts. If compromise is suspected, preserve appliance logs and configuration, rotate credentials, compare configuration against a known-good backup, and inspect adjacent authentication systems for credential reuse or follow-on access.

• /autheditpwd.php
• hid_id=
• /autheditpwd.php?hid_id=
• POST /autheditpwd.php
• GET /autheditpwd.php
• hid_id=%27
• hid_id='
• hid_id=%22
• hid_id="
• UNION SELECT
• union select
• information_schema
• SLEEP(
• sleep(
• BENCHMARK(
• benchmark(
• WAITFOR DELAY
• --
• %2D%2D
• /*
• */
• SQL syntax
• mysql_fetch
• You have an error in your SQL syntax

What your security team should do

• Immediately inventory for D-Link DAR-8000 appliances and prioritize any internet-facing or broadly reachable management interfaces.
• Plan replacement or decommissioning as the primary remediation because the affected product is unsupported.
• Until retirement, restrict management access to a small set of trusted administrative hosts or VPN ranges and block access from general user networks and the internet.
• Reset administrative credentials and review account lists if suspicious requests to /autheditpwd.php are found.
• Search historical web, proxy, WAF, and device logs for SQL injection patterns targeting the hid_id parameter.
• Create SIEM detections for /autheditpwd.php requests containing SQL metacharacters, UNION/SELECT patterns, time-delay functions, or information_schema references.
• If Debian package exposure is relevant in vulnerability tooling, verify webkit2gtk and wpewebkit are updated to the fixed versions provided in the advisory data.