CVE-2015-1013: SQL Injection
Published May 26, 2015
·Updated
OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.
Affected Software
2 affected components
OSIsoft PI Server=2.6
OSIsoft PI SQL for AF=2.1.2.19
Event History
May 26, 2015
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1013?
CVE-2015-1013 is classified as a medium severity vulnerability.
2
How do I fix CVE-2015-1013?
To fix CVE-2015-1013, ensure that the PI SQL Trusted Users group does not include the Everyone account.
3
What are the affected versions in CVE-2015-1013?
CVE-2015-1013 affects OSIsoft PI AF versions 2.6 and 2.7, and PI SQL for AF version 2.1.2.19.
4
What type of users can exploit CVE-2015-1013?
Remote authenticated users can exploit CVE-2015-1013 by bypassing command restrictions through SQL statements.
5
Is there a workaround for CVE-2015-1013?
The primary workaround for CVE-2015-1013 is to review and adjust the membership of the PI SQL Trusted Users group.