Shandong Kede Electronics IoT Smart Water Meter Monitoring Platform SQL Injection Vulnerability Allowing Remote Code Execution

A SQL injection vulnerability has been identified in the IoT smart water meter monitoring platform by Shandong Kede Electronics, specifically in version 1.0. This vulnerability allows remote attackers to execute arbitrary code by exploiting the 'imei_list.aspx' file. The issue arises in the 'txtJZRQ' parameter of the query function on an unauthorized page.

Impact

Exploitation of this vulnerability allows for unauthorized remote code execution on the server where the application is hosted.

Reproduction

To reproduce this vulnerability, send a crafted SQL injection payload through the 'txtJZRQ' parameter on the 'imei_list.aspx' page. The injection can bypass filters and, once executed, can be used to run commands on the server by enabling the 'xp_cmdshell' stored procedure. For example, after executing a command like 'ping', the response can be observed in the DNS logs.