CVE-2026-3843CWE-89sql-injection

CVE-2026-3843

Critical · published March 10, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
61.8
In the wild
Unconfirmed
What it is

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00977 · 61.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-10T22:19Z
Affected products (1)
ProductVersionsFixed in
bukts/buk_ts-g_gas_station_automation_system≥ 2.9.1, < 2.10.22.10.2
References (2)
https://bdu.fstec.ru/vul/2025-13914 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://bukts.ru/repo-bukts-current · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 10 MAR 11:07Z
    SQL Injection in Nefteprodukttekhnika BUK TS-G Allows Remote Code Execution
    cvelistv5