Threat Encyclopedia

Delta.IA.DIAEnergie.CVE-2022-41133.SQL.Injection

Description

This indicates an attack attempt to exploit an SQL Injection Vulnerability in Delta Electronics DIAEnergie.
The vulnerability is due to insufficient input validation when processing requests to the GetDIAE_line_message_settingsListParameters endpoint. A remote attacker can exploit this vulnerability by sending a specially crafted request. Successful exploitation could result in the execution of arbitrary code on the target system within the context of NT SERVICE\MSSQLSERVER.

Affected Products

Delta Electronics DIAEnergie prior to 1.9.01.002

Impact

System Compromise: Remote attackers can add, view, delete or modify data in the database of the affected application

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&CID=06&itemID=060702&sort_expr=cdate&sort_dir=DESC

CVE References

CVE-2022-41133

Telemetry