CVE-2018-7841 Schneider Electric U.motion Builder SQL Injection
SQL injection in U.motion Builder allows attackers to execute unwanted code via improper character input.
- Exploited in the wild
- Since 15 Apr 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7841?
CVE-2018-7841 is a critical SQL injection vulnerability in U.motion Builder software version 1.3.4, published on 22 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
Weakness: CWE-89
Which versions are affected by CVE-2018-7841?
It affects 1 product.
Products include Schneider-Electric U.motion Builder.
How do I fix CVE-2018-7841?
No fix has been published for CVE-2018-7841 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 6 May 2022.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2018-7841 being exploited?
Yes. Attackers have exploited CVE-2018-7841 in the wild since at least 15 Apr 2022.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in U.motion Builder software version 1.3.4
Sources
Also known as GHSA-cwjr-6hc3-vpjm.