CVE-2022-22524CWE-89

SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access

Critical · published September 28, 2022

CVSS v3.1
9.4
EPSS
1%
Percentile
68.7
In the wild
Unconfirmed
What it is

🚨 A sneaky SQL injection lurks in Carlo Gavazzi UWP3.0 and CPY Car Park Server, allowing an unauthenticated attacker to wield full database control! 🔥 Think of this vulnerability like a restaurant where any uninvited guest can walk in, grab the chef's secret recipes, and even change the menu at will! It's a recipe for disaster if we don’t act quickly! An attacker could stroll right into your database—altering user accounts, halting services, and causing absolute chaos. This could lead to massive data loss and disruption to operations, leaving your system wide open to further attacks!

Put simply

Think of this vulnerability like a restaurant where any uninvited guest can walk in, grab the chef's secret recipes, and even change the menu at will! It's a recipe for disaster if we don’t act quickly! This critical SQL injection vulnerability allows unauthenticated attackers to gain unrestricted access to the database by manipulating SQL queries. This means they can read, modify, or delete sensitive information.

What to do

An attacker could stroll right into your database—altering user accounts, halting services, and causing absolute chaos. This could lead to massive data loss and disruption to operations, leaving your system wide open to further attacks! Immediately patch to the latest version of Carlo Gavazzi UWP3.0 and CPY Car Park Server. Implement strong input validation and parameterized queries to safeguard against these types of attacks. You've got this! Follow these steps, and you'll be one step closer to locking down your database! 🛡️

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.01231 · 68.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-09-28T13:45Z
EPSS history
Timeline
  • 28 SEP 13:45Z
    SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access
    cvelistv5