CVE-2026-125612

Summary

A SQL injection flaw exists in Deltaww DIAEnergie due to improper neutralization of user-supplied input in SQL commands, allowing attackers with low privileges to execute arbitrary SQL queries. This affects versions prior to 1.11.01.032 and could lead to full data compromise.

Exploitability

Exploitation requires low-privilege network access (authenticated or unauthenticated depending on endpoint exposure) and no user interaction; the vulnerability is straightforward to exploit using standard SQL injection techniques.

Blast radius

Successful exploitation could enable full database exfiltration, modification, or deletion, potentially disrupting critical energy infrastructure operations dependent on DIAEnergie.

Detection

Defenders should monitor web server and application logs for SQL injection patterns such as single quotes, UNION SELECT, OR 1=1, or time-based delays in HTTP request parameters; look for异常 HTTP 500 responses or unusually long query execution times in database logs. No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade DIAEnergie to version 1.11.01.032 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.