Karelips
Monthly
Blind SQL injection in KarelIPS, the IP/PBX-adjacent product from Karel Electronic Industry and Trade Inc., allows unauthenticated remote attackers who can reach the product's network-exposed input to inject SQL and infer database contents through boolean- or time-based responses. All versions through 22092026 are affected, and the vendor-contacted via TR-CERT-has stated the product is no longer supported, so no vendor fix is expected; no public exploit code has been identified at time of analysis, and the blind nature of the injection makes data extraction slow and inference-driven rather than immediate. The advisory claims CVSS 9.8 (C:H/I:H/A:H), but the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, High) reflects the more likely case: certain high-impact confidentiality loss, with integrity and availability effects contingent on the privileges of the underlying database account and therefore deployment-dependent.
Blind SQL injection in KarelIPS, the IP/PBX-adjacent product from Karel Electronic Industry and Trade Inc., allows unauthenticated remote attackers who can reach the product's network-exposed input to inject SQL and infer database contents through boolean- or time-based responses. All versions through 22092026 are affected, and the vendor-contacted via TR-CERT-has stated the product is no longer supported, so no vendor fix is expected; no public exploit code has been identified at time of analysis, and the blind nature of the injection makes data extraction slow and inference-driven rather than immediate. The advisory claims CVSS 9.8 (C:H/I:H/A:H), but the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, High) reflects the more likely case: certain high-impact confidentiality loss, with integrity and availability effects contingent on the privileges of the underlying database account and therefore deployment-dependent.