CVE-2021-3958 - OpenCVE

Improper Handling of Parameters vulnerability in Ipack Automation Systems Ipack SCADA Software allows : Blind SQL Injection.This issue affects Ipack SCADA Software: from unspecified before 1.1.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ipack	Scada Automation

Configuration 1 [-]

cpe:2.3:a:ipack:scada_automation:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/paradessia/cve/blob/main/Ipack-Scada-Automation.txt

History

Tue, 17 Sep 2024 02:30:00 +0000

Type	Values Removed	Values Added
Description	Improper Handling of Parameters vulnerability in Ipack Automation Systems Ipack SCADA Software allows : Blind SQL Injection.This issue affects Ipack SCADA Software: from unspecified before 1.1.0.	Improper Handling of Parameters vulnerability in Ipack Automation Systems Ipack SCADA Software allows : Blind SQL Injection.This issue affects Ipack SCADA Software: from unspecified before 1.1.0.

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2021-11-16T15:46:57.396925Z

Updated: 2024-09-17T02:21:53.159Z

Reserved: 2021-11-15T00:00:00

Link: CVE-2021-3958

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-11-16T16:15:06.873

Modified: 2024-09-17T03:15:38.020

Link: CVE-2021-3958

Redhat

No data.

{"containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Ipack SCADA Software", "vendor": "Ipack Automation Systems", "versions": [{"lessThan": "1.1.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Onurhan ERDOGDU"}], "datePublic": "2021-12-09T21:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Handling of Parameters vulnerability in Ipack Automation Systems Ipack SCADA Software allows : Blind SQL Injection.<p>This issue affects Ipack SCADA Software: from unspecified before 1.1.0.</p>"}], "value": "Improper Handling of Parameters vulnerability in Ipack Automation Systems Ipack SCADA Software allows : Blind SQL Injection.This issue affects Ipack SCADA Software: from unspecified before 1.1.0."}], "impacts": [{"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "CAPEC-7 Blind SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2023-09-03T16:03:05.258Z"}, "references": [{"tags": ["exploit"], "url": "https://github.com/paradessia/cve/blob/main/Ipack-Scada-Automation.txt"}], "source": {"advisory": "CVE-2021-3958", "defect": ["CVE-2021-3958"], "discovery": "EXTERNAL"}, "title": "SQL Injection Vulnerability in Ipack SCADA Software", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@usom.gov.tr", "DATE_PUBLIC": "2021-12-10T21:00:00.000Z", "ID": "CVE-2021-3958", "STATE": "PUBLIC", "TITLE": "Ipack SCADA Automation Remote SQL Injection Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SCADA Automation", "version": {"version_data": [{"version_affected": "<", "version_value": "1.1.0"}]}}]}, "vendor_name": "iPack"}]}}, "credit": [{"lang": "eng", "value": "Onurhan ERDO\u011eDU"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Due to improper sanitization iPack SCADA Automation software suffers from a remote SQL injection vulnerability. An unauthenticated attacker with the web access is able to extract critical information from the system."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "references": {"reference_data": [{"name": "https://github.com/paradessia/cve/blob/main/Ipack-Scada-Automation.txt", "refsource": "MISC", "url": "https://github.com/paradessia/cve/blob/main/Ipack-Scada-Automation.txt"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:09:09.631Z"}, "title": "CVE Program Container", "references": [{"tags": ["exploit", "x_transferred"], "url": "https://github.com/paradessia/cve/blob/main/Ipack-Scada-Automation.txt"}]}]}, "cveMetadata": {"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "assignerShortName": "TR-CERT", "cveId": "CVE-2021-3958", "datePublished": "2021-11-16T15:46:57.396925Z", "dateReserved": "2021-11-15T00:00:00", "dateUpdated": "2024-09-17T02:21:53.159Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ipack:scada_automation:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D15023C-D4F7-4F82-A85E-E02215E3BB57", "versionEndExcluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Handling of Parameters vulnerability in Ipack Automation Systems Ipack SCADA Software allows : Blind SQL Injection.This issue affects Ipack SCADA Software: from unspecified before 1.1.0."}, {"lang": "es", "value": "Debido a un saneo inapropiado, iPack SCADA Automation software sufre una vulnerabilidad de inyecci\u00f3n SQL remota. Un atacante no autenticado con acceso a la web es capaz de extraer informaci\u00f3n cr\u00edtica del sistema"}], "id": "CVE-2021-3958", "lastModified": "2024-09-17T03:15:38.020", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "iletisim@usom.gov.tr", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2021-11-16T16:15:06.873", "references": [{"source": "iletisim@usom.gov.tr", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/paradessia/cve/blob/main/Ipack-Scada-Automation.txt"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "iletisim@usom.gov.tr", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Secondary"}]}