This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: SQL Injection in DESCOR INFOCAD. <br>๐ฅ **Consequences**: Full system compromise. Attackers can steal, modify, or delete data. Critical integrity and availability risks.
Q2Root Cause? (CWE/Flaw)
๐ก๏ธ **Root Cause**: **CWE-89** (Improper Neutralization of Special Elements used in an SQL Command). <br>๐ **Flaw**: Unsanitized user input directly executed in database queries.
Q3Who is affected? (Versions/Components)
๐ข **Vendor**: Descor. <br>๐ฆ **Product**: INFOCAD FM (BIM & Facility Management). <br>๐ **Affected**: Versions **3.5.1 and earlier**.
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Privileges**: High. <br>๐ **Data**: Full access to sensitive BIM and facility management data. <br>โ ๏ธ **Impact**: Complete confidentiality, integrity, and availability loss (CVSS H).
Q5Is exploitation threshold high? (Auth/Config)
๐ **Threshold**: **LOW**. <br>๐ **Network**: Attack Vector is Network (AV:N). <br>๐ **Auth**: No Privileges Required (PR:N). <br>๐ **UI**: No User Interaction needed (UI:N).
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Exploit**: Public references exist (Changelog). <br>๐ซ **PoC**: No specific PoC code provided in data. <br>โ ๏ธ **Risk**: Likely exploitable given CVSS 3.1/AV:N/AC:L.
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for SQL injection patterns in web inputs. <br>๐ ๏ธ **Tool**: Use SQLMap or similar DAST tools on INFOCAD FM endpoints. <br>๐ **Verify**: Check installed version against 3.5.1.
Q8Is it fixed officially? (Patch/Mitigation)
๐ฉน **Fix**: Update to a version **newer than 3.5.1**. <br>๐ข **Source**: Check Descor's official changelog for the patch. <br>โ **Status**: Patch available via vendor update.
Q9What if no patch? (Workaround)
๐ง **Workaround**: Implement strict input validation. <br>๐ก๏ธ **Defense**: Use Web Application Firewall (WAF) rules to block SQL syntax. <br>๐ **Limit**: Restrict network access to the application if possible.
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Urgency**: **CRITICAL**. <br>๐ **Priority**: Immediate action required. <br>๐ **Reason**: High CVSS score, no auth needed, network-accessible. Patch ASAP.