PT-2023-3021 · Postgresql · Postgresql

Momen Eldawakhly · Published 2023-05-11 · Updated 2023-05-24 · CVE-2023-1934

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PnPSCADA (affected versions not specified)

Description The PnPSCADA system is affected by a critical unauthenticated error-based PostgreSQL Injection vulnerability. This security flaw is present within the "hitlogcsv.jsp" endpoint, allowing unauthenticated attackers to engage with the underlying database seamlessly and passively. As a result, malicious actors could gain access to vital information, such as Industrial Control System (ICS) and OT data, alongside other sensitive records like SMS and SMS Logs. The unauthorized database access exposes compromised systems to potential manipulation or breach of essential infrastructure data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the "hitlogcsv.jsp" endpoint to minimize the risk of exploitation. Additionally, limiting database privileges and monitoring database activity can help mitigate the risk of unauthorized access.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-03085

CVE-2023-1934

Affected Products

Postgresql

References · 8

• 🔥 https://exploit-db.com/exploits/51448 · Exploit
• https://osv.dev/vulnerability/CVE-2023-1934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1934 · Security Note
• https://bdu.fstec.ru/vul/2023-03085 · Security Note
• https://t.me/cvenotify/51071 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-131-12 · Note
• https://t.me/cibsecurity/64026 · Telegram Post
• http://packetstormsecurity.com/files/172511/PnPSCADA-2.x-SQL-Injection.html · Note