Nefteprodukttekhnika BUK TS-G Gas Station Automation System SQL Injection Vulnerability Allowing Remote Code Execution

A SQL injection vulnerability has been identified in the Nefteprodukttekhnika BUK TS-G Gas Station Automation System version 2.9.1 on Linux. The vulnerability exists in the system configuration module, where a remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint. By manipulating the sql parameter in the application/x-www-form-urlencoded data, attackers can execute arbitrary SQL commands. This exploitation could potentially lead to remote code execution.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can execute arbitrary SQL commands. This could be used to manipulate the database, extract sensitive information, or in some cases, achieve remote code execution.