by Kastro
Paper/Archive/CVE-2022-4557

CVE-2022-4557

Group Arge Energy and Control Systems Smartpower Web — SQL Injection in Smartpower Web

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.5.515 × 2010.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.

Affected

ProductAffectedFixed inSource
Smartpower Web< 23.01.0123.01.01CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-23-0066refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0066