{"id":"CVE-2012-5861","aliases":["EUVD-2012-5739","GHSA-f4r2-hvg9-43x3"],"status":"published","title":"Sinapsi eSolar SQL Injection","description":"These Sinapsi devices do not check the validity of the data before \nexecuting queries. By accessing the SQL table of certain pages that do \nnot require authentication within the device, attackers can leak \ninformation from the device. This could allow the attacker to compromise\n confidentiality.","severity":{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.04239,"percentile":0.9109,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2012-11-23T11:00:00Z","modified":"2026-06-16T23:47:28Z","exploits":[{"source":"exploitdb","id":"EDB-21273","title":"Ezylog Photovoltaic Management Server - Multiple Vulnerabilities","type":"webapps","platform":"php","date":"2012-09-12","url":"https://www.exploit-db.com/exploits/21273"}],"products":[{"vendor":"sinapsi","product":"esolar"},{"vendor":"sinapsi","product":"esolar duo"},{"vendor":"sinapsi","product":"esolar light"},{"vendor":"sinapsitech","product":"esolar_duo_photovoltaic_system_monitor"},{"vendor":"sinapsitech","product":"esolar_light_photovoltaic_system_monitor"},{"vendor":"sinapsitech","product":"esolar_photovoltaic_system_monitor"},{"vendor":"sinapsitech","product":"sinapsi_firmware"}],"references":[{"url":"http://www.exploit-db.com/exploits/21273/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80200","tags":["vdb-entry","x_refsource_XF"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01"},{"url":"http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf","tags":["x_refsource_MISC","x_transferred","US Government Resource"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80201","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5861"},{"url":"http://www.exploit-db.com/exploits/21273"},{"url":"https://github.com/advisories/GHSA-f4r2-hvg9-43x3"}],"sources":{"cve":[{"id":"CVE-2012-5861","title":"Sinapsi eSolar SQL Injection","description":"These Sinapsi devices do not check the validity of the data before \nexecuting queries. By accessing the SQL table of certain pages that do \nnot require authentication within the device, attackers can leak \ninformation from the device. This could allow the attacker to compromise\n confidentiality.","status":"published","published":"2012-11-23T11:00:00Z","modified":"2025-07-08T15:23:14.405Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:49.246229Z"}],"euvd":[{"id":"EUVD-2012-5739","description":"These Sinapsi devices do not check the validity of the data before \nexecuting queries. By accessing the SQL table of certain pages that do \nnot require authentication within the device, attackers can leak \ninformation from the device. This could allow the attacker to compromise\n confidentiality.","status":"published","published":"2012-11-23T11:00:00Z","modified":"2025-07-08T15:23:14Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:12.59227Z"}],"ghsa":[{"id":"GHSA-f4r2-hvg9-43x3","title":"Multiple SQL injection vulnerabilities on the Sinapsi eSolar Light Photovoltaic System Monitor ...","description":"Multiple SQL injection vulnerabilities on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allow remote attackers to execute arbitrary SQL commands via (1) the inverterselect parameter in a primo action to dettagliinverter.php or (2) the lingua parameter to changelanguagesession.php.","status":"published","published":"2022-05-17T01:38:31Z","modified":"2025-07-08T18:31:29Z","cwes":["CWE-89"],"updated_at":"2026-11-02T15:02:56.619633Z"}],"nvd":[{"id":"CVE-2012-5861","description":"These Sinapsi devices do not check the validity of the data before \nexecuting queries. By accessing the SQL table of certain pages that do \nnot require authentication within the device, attackers can leak \ninformation from the device. This could allow the attacker to compromise\n confidentiality.","status":"published","published":"2012-11-23T12:09:58.367Z","modified":"2026-06-16T23:47:28.683Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:02:16.536025Z"}]}}