CVE-2022-1366: SQL Injection

Q: What is the vulnerability ID for this issue?

This vulnerability is identified by the ID CVE-2022-1366.

Q: What is the affected software?

The affected software is Delta Electronics DIAEnergie versions prior to 1.8.02.004.

Q: What is the severity of CVE-2022-1366?

The severity of this vulnerability is critical with a CVSS score of 9.8.

Q: What is the vulnerability description?

CVE-2022-1366 is a blind SQL injection vulnerability in Delta Electronics DIAEnergie, allowing attackers to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

Q: Is there a fix available for CVE-2022-1366?

Yes, updating Delta Electronics DIAEnergie to version 1.8.02.004 or later will fix this vulnerability.

Published May 2, 2022

Updated

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

Affected Software

2 affected componentsFixes available

Delta Electronics DIAEnergie<1.9

1.9

Deltaww Diaenergie<1.8.02.004

Remediation

Information

Delta Electronics has fixed the reported vulnerabilities in Version 1.08.02.004. Users should contact Delta customer service or a Delta representative for this release, as it will not be released publicly. Delta is working on a public release that will include these fixes and other features on June 30, 2022.

Event History

May 2, 2022

CVE Published

via MITRE·06:01 PM

Data Sourced

via MITRE·06:01 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-22-081-01

Frequently Asked Questions

What is the vulnerability ID for this issue?