ScadaLTS vulnerabilities

ScadaLTS 2.8.1-release-candidate build 0 suffers from an authorization bypass in DWR endpoints. Spring Security gates by URL pattern, but DWR dispatches based on POST body parameters, allowing any authenticated user to invoke any DWR method.

An authenticated blind SQL injection vulnerability in ScadaLTS 2.8.1-release-candidate build 0 in the /api/events/search endpoint. The sortBy array values are concatenated directly into the SQL ORDER BY clause without sanitization, allowing authenticated users with ROLE_USER to perform time-based and boolean-based blind SQL injection to extract arbitrary data, including password hashes of all users.

ScadaLTS 2.8.1-release-candidate build 0 has a remote code execution (RCE) vulnerability via scripting sandbox bypass. The validateScript method in DataSourceEditDwr compiles and executes attacker-supplied JavaScript without authorization, which can be exploited by a low-privileged user.

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.