Which versions of PHP are affected by CVE-2026-3843?

A critical SQL injection vulnerability in Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 could allow attackers to compromise system configurations, steal operational data, or…

How to fix or mitigate CVE-2026-3843?

Within 24 hours: Inventory all systems running BUK TS-G 2.9.1, isolate affected systems from untrusted networks, and restrict administrative access. Within 7 days: Implement network segmentation to limit system access, deploy WAF rules blocking SQL injection patterns, disable remote configuration module access if operationally feasible, and establish 24/7 monitoring for suspicious database queries. Within 30 days: Contact vendor for patch status and timeline, evaluate alternative systems or upgrade to patched version when available, and conduct forensic audit for signs of prior exploitation.

PHP CVE-2026-3843

Q: What is the CVSS score of CVE-2026-3843?

CVE-2026-3843 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

CRITICAL

SQL Injection (CWE-89)

2026-03-10 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

PHP RCE SQLi

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 07, 2026 - 20:37 vuln.today

cvss_changed

CVSS changed

May 07, 2026 - 20:37 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:19 nvd

CRITICAL 9.8

DescriptionCVE.org

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.