PT-2018-18270

Name of the Vulnerable Software and Affected Versions: Schneider Electric U.motion Builder versions prior to 1.3.4 Description: The issue exists in the processing of nfcserver.php, where the underlying SQLite database query is subject to SQL injection on the sessionid input parameter...

CVE-2018-7773: Improper Neutralization of Special Elements used in an SQL Command

The vulnerability exists within processing of nfcserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the sessionid input parameter...

Schneider Electric U.motion Builder nfcserver.php SQL Injection (CVE-2017-7973)

An SQL injection vulnerability exists in Schneider Electric U.motion Builder. The vulnerability is due to insufficient validation of the sessionid HTTP request parameter in requests made to nfcserver.php.A remote, unauthenticated user can exploit this vulnerability by sending a crafted HTTP reque...