Description
A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltrate all data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siempelkamp | UmweltOffice | < 7.4.3 | 7.4.3 |
References
- https://www.syss.de/pentest-blog/sql-injection-in-siempelkamp-nis-umweltoffice third-party-advisory