CVE-2017-7973

Critical

Published: 26/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior, allowing unauthenticated users to execute arbitrary SQL commands against the underlying database.

Risk Assessment

This vulnerability may lead to unauthorized access and modification of data, posing a serious threat to the integrity and confidentiality of information within the organization.

Recommendation

It is recommended to update the U.motion Builder software to the latest version to mitigate this vulnerability and implement additional security measures such as access control.

Original NVD description (English source)

A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can use calls to various paths allowing performance of arbitrary SQL commands against the underlying database.