A critical SQL injection vulnerability in the Nefteprodukttekhnika BUK TS-G Gas Station Automation System allows remote, unauthenticated attackers to achieve potential remote code execution.

The application is susceptible to SQL injection (CWE-89) within the sql parameter of the /php/request.php endpoint. This flaw allows an unauthenticated remote attacker to inject arbitrary SQL commands, resulting in full database compromise and potential execution of operating system-level code.

Successful exploitation of this vulnerability could lead to a complete compromise of the gas station automation infrastructure. Given the CVSS score of 9.8, this poses a severe risk of unauthorized data access, manipulation of critical operational parameters, and significant system downtime, potentially impacting revenue and physical safety.

Immediate Action: Update the BUK TS-G Gas Station Automation System to version 2.10.2 or later immediately.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed at /php/request.php containing suspicious SQL keywords.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize input containing SQL syntax in the sql parameter of the affected endpoint.

Public Exploit Available: Unknown.

The extreme severity of this vulnerability necessitates immediate patching. Organizations operating BUK TS-G systems must prioritize upgrading to version 2.10.2 to eliminate the risk of unauthenticated remote code execution.