Integratec
Monthly
SQL injection in Integratec's pre-authentication login endpoint (/login/ap_Login.aspx/start) allows remote unauthenticated attackers to read database contents-including credentials and user information-by supplying a crafted UNION-based payload in the sInfo POST parameter. The report carries an 8.8 CVSS score, and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, with no authentication or user interaction required; exploitation is limited mainly by whether the login interface is reachable from untrusted networks. No public exploit code was identified at time of analysis, but our independent assessment treats this as a credible, actionable priority rather than a paper-tiger high score.
SQL injection in Integratec's pre-authentication login endpoint (/login/ap_Login.aspx/start) allows remote unauthenticated attackers to read database contents-including credentials and user information-by supplying a crafted UNION-based payload in the sInfo POST parameter. The report carries an 8.8 CVSS score, and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, with no authentication or user interaction required; exploitation is limited mainly by whether the login interface is reachable from untrusted networks. No public exploit code was identified at time of analysis, but our independent assessment treats this as a credible, actionable priority rather than a paper-tiger high score.