critical9.8Known exploitedPublic exploit code
CVE-2018-7841
Schneider Electric U.motion Builder SQL Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-04-15. Federal due date: 2022-05-06.
The impacted product is end-of-life and should be disconnected if still in use.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
Impact
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Schneider-Electric | U.Motion Builder | Version 1.3.4 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html
- http://seclists.org/fulldisclosure/2019/May/26
- https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-02
- http://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html
- http://seclists.org/fulldisclosure/2019/May/26
- https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-02
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7841