Delta Electronics DIAEnergie SQL Injection in DIAE_dmdsetHandler.ashx

Vulnerability

CVE-2022-26013 is a blind SQL injection vulnerability in Delta Electronics DIAEnergie industrial energy management software, specifically in the DIAE_dmdsetHandler.ashx endpoint. The vulnerability affects all versions prior to 1.8.02.004. An attacker can inject arbitrary SQL queries without authentication.

Exploitation

An unauthenticated attacker can exploit this vulnerability remotely over the network by sending crafted HTTP requests to the affected endpoint. The attack complexity is low and does not require user interaction. Blind SQL injection techniques can be used to extract data.

Impact

Successful exploitation allows an attacker to retrieve and modify database contents, and potentially execute system commands on the underlying server, leading to full compromise of confidentiality, integrity, and availability.

Mitigation

Delta Electronics has released version 1.8.02.004 to address this vulnerability. Users should update to this version or later. No workarounds are known. The CISA advisory [1] provides additional guidance.