← CVE Intelligence

CVE-2026-3843

SQL Injection in Nefteprodukttekhnika BUK TS-G Allows Remote Code Execution PUBLISHED

Description (CNA)

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.

Affected (CNA)

Vendor / productVersions
Nefteprodukttekhnika LLC / BUK TS-G Gas Station Automation Systemaffected 2.9.1 through 2.10.2; unaffected 2.10.2

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.