Delta Electronics DIAEnergie SQL Injection (CVE-2021-38391)

An SQL injection exists in Delta Industrial Automation DIAEnergie. The vulnerability is due to an input validation error when processing the type parameter in the AMHandler.ashx endpoint...

CVE-2021-38391: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability exists in the /DataHandler/AM/AMHandler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A...