CVE-2012-5861
published 2012-11-23CVE-2012-5861: These Sinapsi devices do not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require…
PriorityP348high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
4.08%
89.4th percentile
These Sinapsi devices do not check the validity of the data before
executing queries. By accessing the SQL table of certain pages that do
not require authentication within the device, attackers can leak
information from the device. This could allow the attacker to compromise
confidentiality.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sinapsi | esolar | < 2.0.2870_xxx_2.2.12 | 2.0.2870_xxx_2.2.12 |
| sinapsi | esolar_duo | < 2.0.2870_xxx_2.2.12 | 2.0.2870_xxx_2.2.12 |
| sinapsi | esolar_light | < 2.0.2870_xxx_2.2.12 | 2.0.2870_xxx_2.2.12 |
| sinapsitech | sinapsi_firmware | <= 2.0.2870 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f4r2-hvg9-43x3: Multiple SQL injection vulnerabilities on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA manag
ghsa_unreviewed·2022-05-17
CVE-2012-5861 [HIGH] CWE-89 GHSA-f4r2-hvg9-43x3: Multiple SQL injection vulnerabilities on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA manag
Multiple SQL injection vulnerabilities on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allow remote attackers to execute arbitrary SQL commands via (1) the inverterselect parameter in a primo action to dettagliinverter.php or (2) the lingua parameter to changelanguagesession.php.
GHSA
GHSA-7qc4-45cg-h6f3: Multiple SQL injection vulnerabilities in Carlo Gavazzi EOS-Box with firmware before 1
ghsa_unreviewed·2022-05-17·CVSS 7.8
CVE-2012-6427 [HIGH] CWE-89 GHSA-7qc4-45cg-h6f3: Multiple SQL injection vulnerabilities in Carlo Gavazzi EOS-Box with firmware before 1
Multiple SQL injection vulnerabilities in Carlo Gavazzi EOS-Box with firmware before 1.0.0.1080_2.1.10 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, a similar issue to CVE-2012-5861.
CISA ICS
Sinapsi Devices Vulnerabilities
cisa_ics·2012-10-10
Sinapsi Devices Vulnerabilities
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Sinapsi Devices Vulnerabilities
Last RevisedJanuary 10, 2020
Alert CodeICSA-12-325-01
## Overview
This advisory is a follow-up to the alert titled ICS-ALERT-12-284-01—Sinapsi eSolar Light Vulnerabilities that was published October 10, 2012.
Independent researchers Roberto Paleari and Ivan Speziale identified four vulnerabilities and released proof-of-concept (exploit) code for the Sinapsi eSolar Light Photovoltaic System Monitor without coordination with ICS-CERT, this vendor, or any other coordinating entity known to ICS-CERT.
The eSolar Light has also been sold with differen
No detection rules found.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.htmlhttp://www.exploit-db.com/exploits/21273/http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88https://exchange.xforce.ibmcloud.com/vulnerabilities/80200https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.htmlhttp://www.exploit-db.com/exploits/21273/http://www.sinapsitech.it/default.asp?active_page_id=78&news_id=88http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdfhttps://exchange.xforce.ibmcloud.com/vulnerabilities/80201
2012-11-23
Published