Description
The vulnerability exists within processing of track_getdata.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the id input parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric SE | U.Motion | U.motion Builder Software, all versions prior to v1.3.4 | — |
Advisories 2
- SEVD-2018-095-01 Security Notification - U.motion Builder software Schneider Electric CPCERT · Feb 11, 2020
- ICSA-17-180-02 Schneider Electric U.motion Builder (Update A) CISA ICS & IT advisories · Jan 8, 2019