CVE-2022-1366

2022-05-0218:01:09

CWE-89

icscert

www.cve.org

delta electronics diaenergie

blind sql injection

handlerchart.ashx

database contents

system commands

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

49.3%

JSON

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

CNA Affected

[
  {
    "product": "DIAEnergie",
    "vendor": "Delta Electronics",
    "versions": [
      {
        "lessThan": "1.8.02.004",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]