Vulnerability identifier: #VU11657

Vulnerability risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-7772

CWE-ID: CWE-89

Exploitation vector: Network

Exploit availability: No

Vulnerable software:

Vendor:

Description
The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.

The weakness exists within processing of applets which are exposed on the web service due to insufficient sanitization of user-supplied data. A remote attacker can submit a specially crafted loginSeed parameter, which can be embedded in the HTTP cookie of the request to vulnerable script and execute arbitrary SQL commands in web application database.

Mitigation
Install update from vendor's website.

Vulnerable software versions

:

---

External links
http://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Id=960747...

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.