Delta Electronics DIAEnergie SQL Injection

Vulnerability

SQL injection vulnerability exists in the Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie, an industrial energy management system. Versions prior to v1.9.02.001 are affected [1]. The flaw is due to improper neutralization of user-supplied input, allowing an attacker to inject arbitrary SQL queries via network requests.

Exploitation

An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request to the Handler_CFG.ashx endpoint. The low attack complexity means no special conditions or user interaction are required [1].

Impact

Successful exploitation allows an attacker to retrieve, modify, or delete database contents, and potentially execute system commands on the underlying server. This could lead to full compromise of the DIAEnergie application and associated data [1].

Mitigation

Delta Electronics has released version v1.9.02.001 to address this vulnerability. Users should update to this version or later. The CISA advisory also recommends applying the update and following security best practices [1].