SQL injection in OPW Fuel Management Systems products - CVE-2017-12731
Published: September 1, 2017
Vulnerability identifier: #VU8069
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12731
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL commands.
The vulnerability exists due to a lack of proper validation on user-supplied input within SQL queries. A remote attacker can inject malicious SQL queries, execute SQL commands and gain access to the system.
The vulnerability exists due to a lack of proper validation on user-supplied input within SQL queries. A remote attacker can inject malicious SQL queries, execute SQL commands and gain access to the system.
Affected software
SiteSentinel iSite
SiteSentinel Integra 100
SiteSentinel Integra 500
SiteSentinel Integra 100
SiteSentinel Integra 500
How to mitigate CVE-2017-12731
Update to version 17Q2.1.