← Database

CVE-2026-3843

CRITICAL CVSS: 9.8 Published: 2026-03-10 Modified: 2026-08-10

Description

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.

Affected Platforms

Linux Linux KernelBukts Buk Ts-G Gas Station Automation System

Weakness Type

CWE-89

References