Description
Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Data Systems Consulting | BPM | unspecified – ≤ 5.8.6.1 | — |