KevinLAB Inc Building Energy Management System 4ST BEMS vulnerabilities

An undocumented backdoor account in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 allows unauthorized access with full administrative privileges. The vulnerability stems from missing access controls and a hidden account.

SQL Injection vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can inject malicious SQL queries via the input_id POST parameter in index.php.

A Directory Traversal vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can exploit the 'page' parameter in index.php to read arbitrary files on the server.