Description

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-24T10:16:40.510Z",
  "pubdate": "2026-08-24T10:16:40.510Z",
  "executiveSummary": "An SQL Injection vulnerability exists within Delta DIAEnergie v1.11.00.002, enabling a remote attacker to achieve arbitrary remote code execution on the underlying host system.\nThe vulnerability exposes the affected software to severe risk, potentially granting an unauthorized threat actor complete system compromise through database manipulation.\nImpact analysis reveals that successful exploitation allows execution of arbitrary commands with the privileges of the database service or application context.\nThe affected product is identified as Delta DIAEnergie version v1.11.00.002, which processes untrusted user-supplied input insecurely within SQL queries.\nAttacker capabilities include network-based exploitation vectors to interact with the vulnerable application endpoints, inject malicious SQL payloads, and leverage database-level features to execute operating system commands.\nExploitation requirements include network accessibility to the vulnerable Delta DIAEnergie instance and the ability to submit crafted requests containing malicious SQL injection strings to the vulnerable parameters or components.",
  "technicalDetails": "The root cause of the vulnerability stems from improper neutralization of special elements used in an SQL command, commonly known as SQL Injection, within Delta DIAEnergie v1.11.00.002.\nThe application accepts user-supplied input and incorporates it directly into database query strings without adequate parameterization, input sanitization, or context-aware escaping.\nThe vulnerable component handles database interactions where user input is concatenated directly into SQL statements, allowing an attacker to manipulate the structure, logic, and execution flow of the database queries.\nAffected versions are strictly limited to Delta DIAEnergie v1.11.00.002 based on the vulnerability disclosure.\nAuthentication requirements and privilege requirements for exploitation are not explicitly constrained, potentially allowing unauthenticated or low-privileged remote attackers to reach the vulnerable database interface depending on network exposure and application configuration.\nNetwork exposure includes accessibility over IP networks where the Delta DIAEnergie web interface or backend services accept incoming client connections.\nThe attack flow proceeds in a step-by-step manner: First, the attacker identifies an input vector within the application that interacts with the backend database insecurely. Second, the attacker crafts a malicious SQL payload designed to subvert the original query logic. Third, the crafted payload is injected via the vulnerable parameter. Fourth, the database executes the manipulated query, allowing the attacker to interact with the underlying database management system. Finally, by leveraging advanced database features such as extended stored procedures, administrative commands, or file write capabilities inherent to the database engine, the attacker translates the SQL injection vector into operating system command execution, thereby achieving remote code execution.\nPayload behavior involves exploiting database privileges to spawn secondary processes or execute system binaries directly from the database context.\nPost-exploitation impact includes full system compromise, data exfiltration, lateral movement within the network, and complete loss of confidentiality, integrity, and availability of the host running Delta DIAEnergie."
}