CVE-2012-5861

Sinapsi eSolar SQL Injection

CVSS 7.8 EPSS 4.1%CWE-89

These Sinapsi devices do not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication within the device, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.

AV:N/AC:L/Au:N/C:C/I:N/A:N

Productos afectados

Sinapsi · eSolar Sinapsi · eSolar DUO Sinapsi · eSolar Light

PoCs públicas encontradas — 2

cve_referencewww.exploit-db.com/exploits/21273/no verificado exploitdbwww.exploit-db.com/exploits/21273no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html https://exchange.xforce.ibmcloud.com/vulnerabilities/80200 https://exchange.xforce.ibmcloud.com/vulnerabilities/80201 https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01 http://www.exploit-db.com/exploits/21273/http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88 http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf