CVE-2023-1934 SQL injection in PnPSCADA
Unauthenticated attackers can exploit SQL injection in PnPSCADA to access and manipulate sensitive ICS/OT data and SMS logs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1934?
CVE-2023-1934 is a critical SQL injection vulnerability in SDG Technologies PnPSCADA, published on 12 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerability. Present within the hitlogcsv.jsp endpoint, this security flaw permits unauthenticated attackers to engage with the underlying database seamlessly and passively. Consequently, malicious actors could gain access to vital information, such as Industrial Control System (ICS) and OT data, alongside other sensitive records like SMS and SMS Logs. The unauthorized database access exposes compromised systems to potential manipulation or breach of essential infrastructure data, highlighting the severity of this vulnerability.
Weakness: CWE-89
Which versions are affected by CVE-2023-1934?
It affects 1 product.
Products include Sdg Pnpscada.
How do I fix CVE-2023-1934?
No fix has been published for CVE-2023-1934 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-1934 being exploited?
There is no known exploitation of CVE-2023-1934 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in SDG Technologies PnPSCADA
Sources
Also known as GHSA-8gvj-4m38-qf6h.