CVE-2026-3843

Katalog CVE

CVSS 9.8 · Critical EPSS 0,98%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada bukts buk ts-g gas station automation system. Skor CVSS 3.1 9.8 (Critical) menurut CNA.

Deskripsi (NVD)

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.

Rincian

Terbit di NVD

10 Maret 2026

Terakhir diubah

10 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bdu.fstec.ru/vul/2025-13914 broken link
• https://bukts.ru/repo-bukts-current broken link