PT-2015-1384 · Osisoft · Osisoft Pi Af+1

Published 2015-05-25 · Updated 2015-05-27 · CVE-2015-1013

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OSIsoft PI AF versions 2.6 through 2.7 PI SQL for AF version 2.1.2.19

Description The issue is related to the lack of protection in the SQL query structure, allowing remote authenticated users to bypass intended command restrictions via SQL statements. This can be exploited by including an account in the Trusted Users group and excluding it from the Everyone group, thus enabling the bypass of SQL command limitations.

Recommendations For OSIsoft PI AF versions 2.6 through 2.7, ensure the PI SQL (AF) Trusted Users group does not include the Everyone account to prevent bypassing of command restrictions. For PI SQL for AF version 2.1.2.19, restrict access to the Trusted Users group and remove the Everyone account from it to mitigate the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2015-10477

CVE-2015-1013

Affected Products

Osisoft Pi Af

Pi Sql For Af

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-1013 · Security Note
• https://bdu.fstec.ru/vul/2015-10477 · Security Note
• https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00280 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01 · Note