SQL Injection in Osisoft Pi Server

CVE-2015-1013

OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements.

Vulnerability class: SQL Injection

EPSS: 0.013 (67.2th percentile) — read the EPSS interpretation.

Affected products

Osisoft Pi_server — versions 2.6
Osisoft Pi_sql_for_af — versions 2.1.2.19
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

ics-cert@hq.dhs.gov (x_refsource_CONFIRM, Vendor Advisory)
ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)