SQL Injection in Controlsystemworks Csworks
CVE-2014-2351
SQL injection vulnerability in the LiveData service in CSWorks before 2.5.5233.0 allows remote attackers to execute arbitrary SQL commands via vectors related to pathnames contained in web API requests.
Vulnerability class: SQL Injection
EPSS: 0.025 (83.1th percentile) — read the EPSS interpretation.
Affected products
- Controlsystemworks Csworks — versions 1.0.601.0, 1.0.612.0, 1.0.623.0
- Csworks — versions 2.5.5233.0, 0
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov
- ics-cert@hq.dhs.gov (x_refsource_CONFIRM, Vendor Advisory)
- ics-cert@hq.dhs.gov (vdb-entry, x_refsource_BID)
- af854a3a-2127-422b-91ae-364da2661108 (US Government Resource)