CVE-2025-34059

Description

An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclose sensitive information.

Reserved 2025-04-15 | Published 2025-07-01 | Updated 2025-07-01 | Assigner VulnCheck

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status
unaffected

Any version
affected

References

www.cnvd.org.cn/flaw/show/CNVD-2024-38747 third-party-advisory

www.cnblogs.com/LeouMaster/p/18509644 exploit

www.dahuatech.com/ product

pentest-tools.com/...orm-sql-injection-cnvd-2024-38747_23762 third-party-advisory

vulncheck.com/...ies/dahua-smart-cloud-gateway-sql-injection third-party-advisory

cve.org (CVE-2025-34059)

nvd.nist.gov (CVE-2025-34059)

Download JSON