critical9.8Public exploit code
CVE-2019-10123
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- AIS logistics ESEL-Server - Unauthenticated SQL Injection Remote Code Execution (Metasploit)2019-04-30 · remote · windows · Verified
Impact
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database. The default user for the database is the 'sa' user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ais | Logistic Software | through 67 |