Authenticated Blind SQL Injection in Computrols CBAS by Computrols
CVE-2019-10852

8.8HIGH

Key Information:

Vendor

Computrols

Status
Computrols Building Automation Software
Vendor
CVE Published:
23 May 2019

What is CVE-2019-10852?

Computrols CBAS version 18.0.0 is vulnerable to an Authenticated Blind SQL Injection attack through the 'id' GET parameter. Attackers can exploit this vulnerability to manipulate backend SQL queries, potentially leading to unauthorized data access or manipulation. Successful exploitation of this vulnerability requires the attacker to have valid authentication credentials, highlighting the importance of securing user accounts and limiting access to essential functionalities.

References

https://applied-risk.com/labs/advisories
x_refsource_MISC
https://applied-risk.com/index.php/download_file/view/196...
x_refsource_MISC
http://packetstormsecurity.com/files/155251/Computrols-CB...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.