CVE-2014-2351

SQL injection vulnerability in the LiveData service in CSWorks before 2.5.5233.0 allows remote attackers to execute arbitrary SQL commands via vectors related to pathnames contained in web API requests.

Score

CVSS 2.0 7.5 High

Status

Modified - ics-cert@hq.dhs.gov

Published

2014-05-20

Last modified

2025-10-03

Weaknesses

CWE-89

Affected products

• Csworks (Controlsystemworks)
• Csworks (Csworks)

References

• http://www.controlsystemworks.com/blogengine/post/2014/05/08/Important-CSWorks-security-release-2552330
• http://www.securityfocus.com/bid/67427
• https://www.cisa.gov/news-events/ics-advisories/icsa-14-135-01
• http://ics-cert.us-cert.gov/advisories/ICSA-14-135-01