A high-severity SQL injection vulnerability in Deltaww DIAEnergie allows authenticated users to compromise database integrity and confidentiality.

This is a SQL injection flaw (CWE-89) in DIAEnergie that allows an authenticated user to perform unauthorized database operations. The vulnerability is triggered via the network with low attack complexity, requiring low privileges to execute.

The ability to perform SQL injection poses a significant risk to the confidentiality, integrity, and availability of the affected system. An attacker could extract sensitive data, modify application records, or potentially gain full control over the backend database. Given the CVSS score of 8.8, this vulnerability represents a high-risk entry point for lateral movement or data exfiltration within the operational network.

Immediate Action: Contact Delta technical support to obtain and upgrade to DIAEnergie version 1.11.00.022 or a later version.

Proactive Monitoring: Review database access logs for unusual query patterns, such as unexpected syntax or large data exports, which may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to inspect and block malicious payloads directed at the DIAEnergie interface.

Public Exploit Available: Unknown

This vulnerability presents a substantial risk to organizational data integrity due to the potential for unauthorized database manipulation. Administrators must prioritize the deployment of the vendor-supplied update to version 1.11.00.022 to eliminate the underlying flaw. Until the update is applied, ensure that access to the DIAEnergie interface is restricted to authorized personnel only to minimize the risk of exploitation by malicious actors.