title: EBM Technologies RISWEB - SQL Injection
description: EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records.
problem types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
defaultStatus: unaffected
product: RISWEB
vendor: EBM Technologies
versions:
status: affected, version: 1.x
status: affected, version: 2.x
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update to 3.x or later version.