Skip to main content

Diaenergie CVE-2024-28891

HIGH
SQL Injection (CWE-89)
2024-03-21 ics-cert@hq.dhs.gov
SQLi Diaenergie
8.8
CVSS 3.1 · Vendor: hq
Share

Severity by source

Vendor (hq) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (hq) · only source for this CVE.

CVSS VectorVendor: hq

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Mar 21, 2024 - 22:15 cve.org
HIGH 8.8

DescriptionCVE.org

SQL injection vulnerability exists in the script Handler_CFG.ashx.

AnalysisAI

SQL injection vulnerability exists in the script Handler_CFG.ashx. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. SQL injection vulnerability exists in the script Handler_CFG.ashx. Affected products include: Deltaww Diaenergie.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

More in Diaenergie

View all
CVE-2024-4548 CRITICAL POC
9.8 May 06

An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'Recalcula
CVE-2024-4547 CRITICAL POC
9.8 May 06

A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'Recalculat
CVE-2024-4549 HIGH POC
7.5 May 06

A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. Rated high severity (CV
CVE-2022-33005 MEDIUM POC
6.1 Jun 27

A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1
CVE-2024-25574 CRITICAL
9.8 Apr 01

SQL injection vulnerability exists in GetDIAE_usListParameters. Rated critical severity (CVSS 9.8), this vulnerability i
CVE-2022-43775 CRITICAL
9.8 Oct 26

The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to ga
CVE-2022-43774 CRITICAL
9.8 Oct 26

The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacke
CVE-2022-3214 CRITICAL
9.8 Sep 16

Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-c
CVE-2022-1378 CRITICAL
9.8 May 02

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_p
CVE-2022-1377 CRITICAL
9.8 May 02

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_r
CVE-2022-1376 CRITICAL
9.8 May 02

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_p
CVE-2022-1375 CRITICAL
9.8 May 02

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_s

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2015-7297 HIGH POC
7.5

Same technique SQLi

View all
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5
CVE-2015-7297 HIGH POC
7.5

Share

CVE-2024-28891 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy