CVE-2022-4557

SQL Injection in Smartpower Web

CVSS 9.8 CRITICALEPSS 0.7%CWE-89

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.8EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

09 Feb 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Group Arge Energy and Control Systems · Smartpower Web

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0066 https://www.usom.gov.tr/bildirim/tr-23-0066