CVE-2026-84859: Scada-LTS Authenticated Blind SQL Injection
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection
The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLEUSER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users.
The endpoint is accessible to any authenticated user with ROLEUSER, ROLEADMIN, or ROLEPUBLIC via POST /api/events/search as defined in spring-security.xml.
Affected Software
Event History
Frequently Asked Questions
Which accounts can reach the affected endpoint?
Any authenticated account with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC can access POST /api/events/search. Exploitation requires authentication, and ROLE_USER is sufficient.
What could an attacker obtain through this issue?
An attacker can use time-based or boolean-based blind SQL injection to extract arbitrary database data, including password hashes for all users.