Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:SQL:INJ:SINAPSI-ESOLAR |
|---|---|
Severity |
Minor |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Sinapsi eSolar Light Photovoltaic System Monitor SQL Injection |
Release Date |
2014/11/18 |
Update Number |
2441 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Sinapsi eSolar Light Photovoltaic System Monitor SQL Injection
This signature detects SQL injection attempts against Sinapsi eSolar Light. A successful attack could result in arbitrary modification of the database.
Extended Description
Multiple SQL injection vulnerabilities on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allow remote attackers to execute arbitrary SQL commands via (1) the inverterselect parameter in a primo action to dettagliinverter.php or (2) the lingua parameter to changelanguagesession.php.
Affected Products
- Sinapsitech esolar_duo_photovoltaic_system_monitor -
- Sinapsitech esolar_light_photovoltaic_system_monitor -
- Sinapsitech esolar_photovoltaic_system_monitor -
- Sinapsitech sinapsi_firmware 2.0.2870
References
- BugTraq: 55872
- CVE: CVE-2012-5861