Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using viewcacert CGI script.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• sonicwall sma 100 firmwareup to 9.0.0.3 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (sonicwall). Independent of NVD's CPE analysis and usually ahead of it.

• SonicWall SMA100

  • 9.0.0.3 and earlieraffected

Other highest-scoring records for the same primary product.

• CVE-2019-7481Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.KEV
  90Now
• CVE-2021-20016A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to accessKEV
  81Now
• CVE-2019-7483In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the preseKEV
  61This week
• CVE-2019-7482Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function libSys.so.
  42Plan
• CVE-2025-32819A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete
  37Monitor
• CVE-2025-32820A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make an
  36Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.