PT-2023-22173 · Unknown · Conprosys Hmi System

C4Ng4C3Ir0 · Publicado 2023-06-01 · Atualizado 2025-01-09 · CVE-2023-29154

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CONPROSYS HMI System (CHS) versions prior to 3.5.3

Description A SQL injection issue exists, allowing a user with administrative privileges to execute arbitrary SQL commands by providing specially crafted input to the query setting page.

Recommendations For versions prior to 3.5.3, update to version 3.5.3 or later to resolve the issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-29154

Produtos afetados

Conprosys Hmi System

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-29154 · Nota de Segurança
• https://jvn.jp/en/vu/JVNVU93372935 · Nota
• https://osv.dev/vulnerability/CVE-2023-29154 · Aviso do Fabricante
• https://contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdf · Aviso do Fabricante
• https://contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdf · Aviso do Fabricante