CVE-2022-1376: SQL Injection
Published May 2, 2022
·Updated
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAEprivgrpHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Affected Software
2 affected componentsFixes available
Delta Electronics DIAEnergie<1.9
1.9
Deltaww Diaenergie<1.8.02.004
Remediation
Information
Delta Electronics has fixed the reported vulnerabilities in Version 1.08.02.004. Users should contact Delta customer service or a Delta representative for this release, as it will not be released publicly. Delta is working on a public release that will include these fixes and other features on June 30, 2022.
Event History
May 2, 2022
CVE Published
via MITRE·06:10 PM
Data Sourced
via MITRE·06:10 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for the blind SQL injection vulnerability in Delta Electronics DIAEnergie?
The vulnerability ID is CVE-2022-1376.
2
What is the affected software?
The affected software is Delta Electronics DIAEnergie, all versions prior to 1.8.02.004.
3
What is the severity of CVE-2022-1376?
The severity of CVE-2022-1376 is critical with a CVSS score of 9.8.
4
How does the blind SQL injection vulnerability in DIAE_privgrpHandler.ashx impact security?
The blind SQL injection vulnerability allows attackers to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
5
How can I fix the blind SQL injection vulnerability in Delta Electronics DIAEnergie?
To fix the vulnerability, update Delta Electronics DIAEnergie to version 1.8.02.004 or later.