Description
A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Delta Electronics DIAEnergie | DIAEnergie Version 1.7.5 and prior | — |
Advisories 1
- ICSA-21-238-03 Delta Electronics DIAEnergie (Update C) CISA ICS & IT advisories · Mar 22, 2022