Description

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-24T10:16:40.810Z",
  "pubdate": "2026-08-24T10:16:40.810Z",
  "executiveSummary": "A critical SQL Injection vulnerability has been identified in Delta DIAEnergie version v1.11.00.002, which ultimately facilitates remote code execution by malicious actors.\nThe vulnerability resides within the application's database interaction layer, where insufficiently sanitized user-supplied input is directly concatenated or improperly bound within SQL queries.\nAn unauthenticated or authenticated attacker capable of interacting with the vulnerable application endpoints can exploit this flaw to manipulate the underlying database logic.\nSuccessful exploitation of this vulnerability has severe risk implications, potentially granting the adversary the ability to execute arbitrary operating system commands with the privileges of the database management system or the hosting web service.\nThe impact compromises the complete confidentiality, integrity, and availability of the affected system, allowing unauthorized data exfiltration, system manipulation, or complete host compromise.\nThis vulnerability represents a significant threat vector within industrial automation and energy management environments utilizing the Delta DIAEnergie software suite, necessitating immediate remediation and defensive hardening measures.",
  "technicalDetails": "The vulnerability is classified as a SQL Injection (SQLi) flaw impacting Delta DIAEnergie v1.11.00.002, specifically within the components responsible for processing database queries derived from user-supplied parameters.\nThe root cause stems from improper input validation and the lack of parameterized queries or prepared statements, allowing specially crafted SQL payloads to alter the intended query structure and execute arbitrary database commands.\nThe attack flow begins when an adversary crafts a malicious HTTP request containing SQL injection payloads targeting vulnerable input fields or parameters exposed by the web application interface.\nUpon receiving the request, the application passes the tainted input directly into backend database query execution routines without adequate sanitization or context-aware escaping.\nBy leveraging advanced SQL injection techniques, such as stacked queries, out-of-band data retrieval, or interaction with extended database server features (e.g., xp_cmdshell in Microsoft SQL Server or equivalent mechanisms depending on the backend DBMS), the attacker transitions from database manipulation to operating system command execution.\nThe execution of arbitrary system commands achieves remote code execution (RCE) on the host running the Delta DIAEnergie service.\nThe network exposure of this vulnerability is determined by the accessibility of the affected Delta DIAEnergie web application interface, which is typically reachable over standard network protocols by users or systems within the environment.\nDepending on the specific configuration and network placement, exploitation may occur remotely across the network without requiring prior authentication or high-level user privileges.\nPost-exploitation impact includes full system compromise, unauthorized access to sensitive operational data, installation of persistent backdoors, and potential lateral movement into connected industrial control system or corporate network segments."
}