Prolink 4G LTE Mobile Wi-Fi DL-7203E SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Prolink 4G LTE Mobile Wi-Fi DL-7203E device, specifically in version 4.0.0B05. The issue arises in the '/reqproc/proc_get' endpoint, where an attacker can inject malicious SQL code into the 'order_by' parameter, potentially manipulating SQL queries and accessing or modifying database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.