CVE-2017-7973

CWE-89 — SQL Injection4 documents4 sources

Severity

9.8CRITICAL

EPSS

0.3%

top 43.53%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Schneider-electric U.motion Builder Schneider Electric SE U.motion

Timeline

PublishedSep 26

Latest updateMay 17

Description

A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can use calls to various paths allowing performance of arbitrary SQL commands against the underlying database.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDschneider-electric/u.motion_builder1.2.1

▶CVEListV5schneider_electric_se/u.motionU.motion Builder Versions 1.2.1 and prior.

🔴Vulnerability Details

GHSA

GHSA-8xpm-cgfj-j3pr: A SQL injection vulnerability exists in Schneider Electric's U↗2022-05-17

▶

CVEList

CVE-2017-7973: A SQL injection vulnerability exists in Schneider Electric's U↗2017-09-25

▶

VulnCheck

Schneider Electric u.motion_builder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')↗2017

▶