Description
The vulnerability exists within processing of track_import_export.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the object_id input parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric SE | U.Motion | U.motion Builder Software, all versions prior to v1.3.4 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Schneider Electric U.motion Builder - SQL Injection http/cves/2018/CVE-2018-7765.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 2
- SEVD-2018-095-01 Security Notification - U.motion Builder software Schneider Electric CPCERT · Feb 11, 2020
- ICSA-17-180-02 Schneider Electric U.motion Builder (Update A) CISA ICS & IT advisories · Jan 8, 2019