CVE-2017-12731 SQL injection in OPW Fuel Management Systems SiteSentinel Integra and SiteSentinel iSite
Attackers can inject malicious SQL queries into OPW Fuel Management Systems consoles, potentially compromising data integrity and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12731?
CVE-2017-12731 is a critical SQL injection vulnerability in OPW Fuel Management Systems SiteSentinel Integra and SiteSentinel iSite, published on 9 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A SQL Injection issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles with the following software versions: older than V175, V175-V189, V191-V195, and V16Q3.1. The application is vulnerable to injection of malicious SQL queries via the input from the client.
Weakness: CWE-89
Which versions are affected by CVE-2017-12731?
It affects 3 products.
Products include Opwglobal Sitesentinel Integra 100 Firmware, Opwglobal Sitesentinel Integra 500 Firmware, Opwglobal Sitesentinel Isite Atg Firmware.
How do I fix CVE-2017-12731?
No fix has been published for CVE-2017-12731 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2017-12731 being exploited?
There is no known exploitation of CVE-2017-12731 in the wild and no public exploit code.
Other vulnerabilities in OPW Fuel Management Systems SiteSentinel Integra and SiteSentinel iSite
Sources
Also known as GHSA-5x4j-xw6f-v62r.