Lucene search

[email protected]CVE-2012-5861

HistoryNov 23, 2012 - 12:09 p.m.

CVE-2012-5861

2012-11-2312:09:58

CWE-89

[email protected]

web.nvd.nist.gov

cve-2012-5861

sql injection

schneider electric

ezylog

photovoltaic

scada

security vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.7 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

74.0%

JSON

Multiple SQL injection vulnerabilities on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allow remote attackers to execute arbitrary SQL commands via (1) the inverterselect parameter in a primo action to dettagliinverter.php or (2) the lingua parameter to changelanguagesession.php.

Affected configurations

NVD

Node

sinapsitechsinapsi_firmwareRange≤2.0.2870

AND

sinapsitechesolar_duo_photovoltaic_system_monitorMatch-

sinapsitechesolar_light_photovoltaic_system_monitorMatch-

sinapsitechesolar_photovoltaic_system_monitorMatch-

CPENameOperatorVersion
sinapsitech:sinapsi_firmwaresinapsitech sinapsi firmwarele2.0.2870
sinapsitech:esolar_duo_photovoltaic_system_monitorsinapsitech esolar duo photovoltaic system monitoreq-
sinapsitech:esolar_light_photovoltaic_system_monitorsinapsitech esolar light photovoltaic system monitoreq-
sinapsitech:esolar_photovoltaic_system_monitorsinapsitech esolar photovoltaic system monitoreq-

CPE	Name	Operator	Version
sinapsitech:sinapsi_firmware	sinapsitech sinapsi firmware	le	2.0.2870
sinapsitech:esolar_duo_photovoltaic_system_monitor	sinapsitech esolar duo photovoltaic system monitor	eq	-
sinapsitech:esolar_light_photovoltaic_system_monitor	sinapsitech esolar light photovoltaic system monitor	eq	-
sinapsitech:esolar_photovoltaic_system_monitor	sinapsitech esolar photovoltaic system monitor	eq	-

References

archives.neohapsis.com/archives/bugtraq/2012-09/0045.html

www.exploit-db.com/exploits/21273/

www.sinapsitech.it/default.asp?active_page_id=78&news_id=88

www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf

exchange.xforce.ibmcloud.com/vulnerabilities/80201

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.7 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

74.0%

JSON

Related for CVE-2012-5861

prion2 cvelist2 nvd2 cve1 ics1