← Back

CVE-2017-12731

nvd nist
Published: Sep 9, 2017Modified: May 13, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

A SQL Injection issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles with the following software versions: older than V175, V175-V189, V191-V195, and V16Q3.1. The application is vulnerable to injection of malicious SQL queries via the input from the client.

Affected (15)

Opwglobal
3 products
Sitesentinel Isite Atg Firmware
Sitesentinel Integra 500 Firmware
Sitesentinel Integra 100 Firmware
Configuration A
5 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Opwglobal
Sitesentinel Isite Atg Firmware
Up to 175
Sitesentinel Isite Atg Firmware
Version 16q3.1
Sitesentinel Isite Atg Firmware
Version 189
Sitesentinel Isite Atg Firmware
Version 191
Sitesentinel Isite Atg Firmware
Version 195
Running on/withPlatform Versions
Opwglobal
Sitesentinel Isite Atg
All versions
Configuration B
5 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Opwglobal
Sitesentinel Integra 500 Firmware
Up to 175
Sitesentinel Integra 500 Firmware
Version 16q3.1
Sitesentinel Integra 500 Firmware
Version 189
Sitesentinel Integra 500 Firmware
Version 191
Sitesentinel Integra 500 Firmware
Version 195
Running on/withPlatform Versions
Opwglobal
Sitesentinel Integra 500
All versions
Configuration C
5 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Opwglobal
Sitesentinel Integra 100 Firmware
Up to 175
Sitesentinel Integra 100 Firmware
Version 16q3.1
Sitesentinel Integra 100 Firmware
Version 189
Sitesentinel Integra 100 Firmware
Version 191
Sitesentinel Integra 100 Firmware
Version 195
Running on/withPlatform Versions
Opwglobal
Sitesentinel Integra 100
All versions

Related CWEs

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (4)

Source: ics-cert@hq.dhs.gov
Third Party AdvisoryVDB Entry
Source: ics-cert@hq.dhs.gov
MitigationThird Party AdvisoryUS Government ResourceVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationThird Party AdvisoryUS Government ResourceVDB Entry

Timeline

No history available yet.