InSAT MasterSCADA BUK-TS SQL Injection Vulnerability Allowing Remote Code Execution

A SQL injection vulnerability has been identified in InSAT MasterSCADA BUK-TS, affecting all versions. This vulnerability exists within the main web interface, where malicious users can exploit a vulnerable endpoint to execute arbitrary code remotely.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the server where InSAT MasterSCADA BUK-TS is running.

Remediation

InSAT has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact info@insat.ru or scada@insat.ru for additional information.