ICS Delta Industrial Automation DIAEnergie Handler_CFG.ashx SQL Injection (CVE-2024-28891)

Rule ID

1234915

Severity

High

Description

An SQL injection vulnerability has been reported for Delta Industrial Automation DIAEnergie. This vulnerability is due to improper input validation in the Handler_CFG.ashx script. A remote, authenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successfully exploiting these vulnerabilities could result in SQL injection or, in the worst case, remote code execution in the context of MSSQLSERVER

Impact

SQL injection

Recommendation

Update vendor's patch.

IPS Category

ICS threats

IPS Anomaly Group

N/A

IPS Rule Default Action

Deny

References

Keywords

N/A