SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy

Vulnerability

A SQL injection vulnerability exists in the Sentilo Proxy server component of Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server (version 2.8.3). The flaw allows an attacker to query other tables of the Sentilo service by injecting malicious SQL statements into the proxy's input [1].

Exploitation

An attacker with network access to the Sentilo Proxy server can exploit this vulnerability without prior authentication. By sending specially crafted requests containing SQL injection payloads, the attacker can manipulate the underlying database queries to retrieve data from arbitrary tables [1].

Impact

Successful exploitation enables the attacker to read sensitive information from the Sentilo database, potentially including credentials, configuration data, or other stored information. The advisory notes that an attacker can gain full access to the affected devices, indicating that this SQL injection may be a stepping stone to broader compromise [1].

Mitigation

As of the advisory publication date (2022-09-26), no specific patch or workaround is disclosed in the available reference [1]. Users are advised to contact Carlo Gavazzi Automation for updated firmware versions and to restrict network access to the Sentilo Proxy server as a temporary measure.