Delta Electronics DIAEnergie SQL Injection in DIAE_HandlerTag_KID.ashx

Vulnerability

A blind SQL injection vulnerability exists in the DIAE_loopmapHandler.ashx endpoint of Delta Electronics DIAEnergie. All versions prior to 1.8.02.004 (and prior to 1.9 per the advisory) are affected. The vulnerability is reachable without authentication and requires no special configuration.

Exploitation

An attacker can exploit this vulnerability remotely over the network with low complexity. No authentication or user interaction is required. By sending a crafted HTTP request to the vulnerable handler with malicious SQL payloads, the attacker can perform blind SQL injection, inferring database contents through response timing or error messages.

Impact

Successful exploitation allows the attacker to retrieve, modify, or delete arbitrary database contents and execute system commands on the underlying server. This leads to full compromise of confidentiality, integrity, and availability of the affected system.

Mitigation

Delta Electronics released version 1.9 to address this vulnerability. Users should update to 1.9 or later. No workarounds are documented in the available references [1].