A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter keyword before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.
References
Link | Resource |
---|---|
https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03 | Third Party Advisory US Government Resource |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: icscert
Published: 2021-08-30T17:33:25
Updated: 2021-08-30T17:33:25
Reserved: 2021-05-13T00:00:00
Link: CVE-2021-32983
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-08-30T18:15:09.307
Modified: 2021-09-07T13:30:13.457
Link: CVE-2021-32983
JSON object: View
Redhat Information
No data.
CWE