Description
SQL injection vulnerability in the LiveData service in CSWorks before 2.5.5233.0 allows remote attackers to execute arbitrary SQL commands via vectors related to pathnames contained in web API requests.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/67427
US Government Resource
http://ics-cert.us-cert.gov/advisories/ICSA-14-135-01
Vendor Advisory x_refsource_confirm
http://www.controlsystemworks.com/blogengine/post/2014/05/08/Important-CSWorks-security-release-2552330
Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-14-135-01
Scores
EPSS
0.0250
EPSS Percentile
83.1%
Details
CWE
CWE-89
Status
published
Products (34)
controlsystemworks/csworks
1.0.601.0
controlsystemworks/csworks
1.0.612.0
controlsystemworks/csworks
1.0.623.0
controlsystemworks/csworks
1.0.720.0
controlsystemworks/csworks
1.0.801.0
controlsystemworks/csworks
1.0.813.0
controlsystemworks/csworks
1.0.901.0
controlsystemworks/csworks
1.0.3540.0
controlsystemworks/csworks
1.0.3560.0
controlsystemworks/csworks
1.0.3580.0
... and 24 more
Published
May 20, 2014
Tracked Since
Feb 18, 2026