CVE-2012-5861 Sinapsi eSolar SQL Injection
HighCVSS 7.5
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
These Sinapsi devices do not check the validity of the data before
executing queries. By accessing the SQL table of certain pages that do
not require authentication within the device, attackers can leak
information from the device. This could allow the attacker to compromise
confidentiality.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sinapsitech sinapsi firmware | <= 2.0.2870 | No fix listed |
| sinapsitech esolar duo photovoltaic system monitor | All versions | No fix listed |
| sinapsitech esolar light photovoltaic system monitor | All versions | No fix listed |
| sinapsitech esolar photovoltaic system monitor | All versions | No fix listed |
| sinapsi eSolar | < 2.0.2870_xxx_2.2.12 | 2.0.2870_xxx_2.2.12 |
| sinapsi eSolar DUO | < 2.0.2870_xxx_2.2.12 | 2.0.2870_xxx_2.2.12 |
| sinapsi eSolar Light | < 2.0.2870_xxx_2.2.12 | 2.0.2870_xxx_2.2.12 |
References
- 20120911 Multiple vulnerabilities in Ezylog photovoltaic management server exploit mailing-list
- 21273 exploit
- www.sinapsitech.it
- sinapsi-default-password(80200) vdb-entry
- www.cisa.gov
- www.us-cert.gov us-government-resource
- sinapsi-sql-injection(80201) vdb-entry