SQL-injection in Car Park Server 3.0 allows for full database access.

Vulnerability

An SQL injection vulnerability exists in the Carlo Gavazzi UWP 3.0 controller (all versions) and the CPY Car Park Server (version 2.8.3) [1]. The flaw resides in an unspecified web interface endpoint that does not sanitize user-supplied input before incorporating it into SQL queries. No authentication or special configuration is required to reach the vulnerable code path; the endpoint is accessible to any network entity that can communicate with the device's embedded web server [1].

Exploitation

A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request containing SQL injection payloads to the affected web interface [1]. The attacker does not need prior network position beyond being able to reach the device over the network. No user interaction is required. The attack proceeds by injecting SQL commands that bypass the intended query logic, allowing the attacker to retrieve arbitrary data from the volatile temporary database that stores the current operational states of the device [1].

Impact

Successful exploitation allows the attacker to read the contents of the device's volatile temporary database, which contains current state information of the UWP 3.0 controller or CPY Car Park Server [1]. The impact is limited to information disclosure of operational state data; the description does not indicate that the attacker can modify the database or execute commands on the device. The attacker gains a low-privilege read access to real-time device state information but does not achieve full device compromise [1].

Mitigation

As of publication, Carlo Gavazzi has not released a patch for the affected products [1]. Users are advised to restrict network access to the web interface of the devices to trusted networks and to monitor vendor advisories for future updates. The devices are not known to be listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. No workaround is provided in the available references [1].