Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQL Injection in Nefteprodukttekhnika BUK TS-G Allows Remote Code Execution
Vulnerability Description
Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Vulnerability Title
Nefte Produkt Tekhnika BUK TS-G Gas Station Automation System 安全漏洞
Vulnerability Description
Nefte Produkt Tekhnika BUK TS-G Gas Station Automation System是俄罗斯Nefte Produkt Tekhnika公司的一个加油站运营自动化系统。 Nefte Produkt Tekhnika BUK TS-G Gas Station Automation System 2.9.1版本存在安全漏洞，该漏洞源于系统配置模块存在SQL注入，可能导致远程攻击者执行任意SQL命令并实现远程代码执行。
CVSS Information
N/A
Vulnerability Type
N/A