SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may execute an arbitrary SQL command via specially crafted input to the query setting page.
References
Configurations
History
21 Nov 2024, 07:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://jvn.jp/en/vu/JVNVU93372935/ - Third Party Advisory | |
| References | () https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdf - Vendor Advisory | |
| References | () https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdf - Vendor Advisory |
08 Jun 2023, 01:53
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Contec
Contec conprosys Hmi System |
|
| References | (MISC) https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdf - Vendor Advisory | |
| References | (MISC) https://jvn.jp/en/vu/JVNVU93372935/ - Third Party Advisory | |
| References | (MISC) https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdf - Vendor Advisory | |
| CWE | CWE-89 | |
| CPE | cpe:2.3:a:contec:conprosys_hmi_system:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
01 Jun 2023, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-01 02:15
Updated : 2024-11-21 07:56
NVD link : CVE-2023-29154
Mitre link : CVE-2023-29154
CVE.ORG link : CVE-2023-29154
JSON object : View
Products Affected
contec
- conprosys_hmi_system
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')