GL-iNet GL-AR300M16 SQL Injection Vulnerability in add_group() Function

A SQL injection vulnerability has been identified in the GL-iNet GL-AR300M16 router, specifically in version 4.3.11. The issue arises in the add_group() function, which improperly constructs and executes SQL queries using user-supplied input. This flaw allows attackers to execute arbitrary SQL operations by sending a crafted HTTP request.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which could be used to manipulate the database, extract sensitive information, or potentially execute further attacks on the device or network.

Reproduction

To reproduce this vulnerability, send a POST request to the router's RPC endpoint with a JSON-RPC payload that includes a crafted SQL injection in the 'group' parameter. The request must be made with an admin token cookie.