CVE-2020-24673 — SQL Injection in Symphony Plus
In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administrat…
Published: 2020-12-22 · CVSS: 9.8 · CVSS 3.1
In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. This can lead to a loss of confidentiality and data integrity or even affect the product behavior and its availability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7