Hydrosystem Control System suffers from widespread SQL injection across many scripts and input parameters. Because the application performs no input validation or parameterization, an attacker with valid user credentials can insert arbitrary SQL statements, allowing full read, write, and deletion of all data stored in the database, which compromises confidentiality, integrity and availability.

Hydrosystem Control System is affected, with all releases prior to version 9.8.5 vulnerable. The fix was delivered in Hydrosystem Control System 9.8.5. All installations of earlier versions run at risk regardless of deployment environment.

The CVSS v3 score of 8.7 indicates high severity, and the flaw requires authentication, which limits exposure compared to unauthenticated vulnerabilities but still allows attackers who have compromised credentials or social engineered access to fully exploit the issue. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, but the high score underscores significant potential impact if an attacker can reach the input vectors.