Siemens SINEC NMS SQL Injection Vulnerability (CNVD-2021-77586)

SINEC NMS is a network management system from Siemens for monitoring and managing industrial networks.A SQL injection vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1, which stems from the lack of validation and escaping of SQL parameter statements in the software. An attacker could use this vulnerability to execute arbitrary commands in the local database by sending a manual request to the affected application’s web server.