Delta Electronics DIAEnergie SQL Injection in HandlerDialog_KID.ashx

Vulnerability

A blind SQL injection vulnerability exists in the HandlerDialog_KID.ashx endpoint of Delta Electronics DIAEnergie, an industrial energy management system, prior to version 1.9 [1]. The vulnerability is due to improper neutralization of special elements used in an SQL command (CWE-89). According to the initial advisory, all versions prior to 1.8.02.004 are affected, but the updated CISA advisory lists all versions prior to 1.9. This is a different endpoint than the SQL injection assigned CVE-2022-26667, which affects GetDemandAnalysisData [1].

Exploitation

An attacker can exploit this vulnerability remotely over a network without authentication or user interaction [1]. The attack complexity is low. The attacker sends specially crafted HTTP requests to the HandlerDialog_KID.ashx endpoint, injecting blind SQL queries into parameters that are not properly sanitized. Because the injection is blind, the attacker may need to infer information through response timing or error messages.

Impact

Successful exploitation allows an attacker to retrieve and modify arbitrary database contents, potentially gaining access to sensitive information stored in the DIAEnergie database. More critically, the description and CISA advisory state that an attacker can also execute arbitrary system commands on the underlying operating system [1]. Given the high CVSS v3 base score of 9.8, this can lead to full compromise of confidentiality, integrity, and availability of the affected system.

Mitigation

Delta Electronics released DIAEnergie version 1.9 to address this vulnerability [1]. All users are recommended to update to version 1.9 or later. As of the latest CISA update (Update C, 2022-04-28), this version is available. No workarounds have been published. If updating is not immediately possible, restricting network access to the DIAEnergie application and monitoring for suspicious requests to HandlerDialog_KID.ashx may reduce risk. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at the time of writing.