PT-2023-3021 · Postgresql · Postgresql

Momen Eldawakhly · Publicado 2023-05-11 · Atualizado 2023-05-24 · CVE-2023-1934

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PnPSCADA (affected versions not specified)

Description The PnPSCADA system is affected by a critical unauthenticated error-based PostgreSQL Injection vulnerability. This security flaw is present within the "hitlogcsv.jsp" endpoint, allowing unauthenticated attackers to engage with the underlying database seamlessly and passively. As a result, malicious actors could gain access to vital information, such as Industrial Control System (ICS) and OT data, alongside other sensitive records like SMS and SMS Logs. The unauthorized database access exposes compromised systems to potential manipulation or breach of essential infrastructure data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the "hitlogcsv.jsp" endpoint to minimize the risk of exploitation. Additionally, limiting database privileges and monitoring database activity can help mitigate the risk of unauthorized access.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-03085

CVE-2023-1934

Produtos afetados

Postgresql

Referências · 8

• 🔥 https://exploit-db.com/exploits/51448 · Exploit
• https://osv.dev/vulnerability/CVE-2023-1934 · Aviso do Fabricante
• https://t.me/cvenotify/51071 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-1934 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-23-131-12 · Nota
• https://bdu.fstec.ru/vul/2023-03085 · Nota de Segurança
• https://t.me/cibsecurity/64026 · Publicação no Telegram
• http://packetstormsecurity.com/files/172511/PnPSCADA-2.x-SQL-Injection.html · Nota