CVE-2012-5861CWE-89

Sinapsi eSolar SQL Injection

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.8epss 4.1%

from disclosure to weapon0 days

Published on NVDNov 23

1st PoCSep 12

exploitation probability

4.1%top 10% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

These Sinapsi devices do not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication within the device, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.

AV:N/AC:L/Au:N/C:C/I:N/A:N

Affected products

Sinapsi · eSolar Sinapsi · eSolar DUO Sinapsi · eSolar Light

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/21273unverified cve_referencewww.exploit-db.com/exploits/21273/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html https://exchange.xforce.ibmcloud.com/vulnerabilities/80200 https://exchange.xforce.ibmcloud.com/vulnerabilities/80201 https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01 http://www.exploit-db.com/exploits/21273/http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88 http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf