CVE-2026-3843

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3843
Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bdu.fstec.ru/vul/2025-13914 Broken Link
https://bukts.ru/repo-bukts-current Broken Link
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:bukts:buk_ts-g_gas_station_automation_system:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
History

07 May 2026, 20:34

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:a:bukts:buk_ts-g_gas_station_automation_system:*:*:*:*:*:*:*:*
First Time Bukts buk Ts-g Gas Station Automation System
Bukts
Linux linux Kernel
Linux
References () https://bdu.fstec.ru/vul/2025-13914 - () https://bdu.fstec.ru/vul/2025-13914 - Broken Link
References () https://bukts.ru/repo-bukts-current - () https://bukts.ru/repo-bukts-current - Broken Link

11 Mar 2026, 13:53

Type Values Removed Values Added
Summary
  • (es) Nefteprodukttekhnika BUK TS-G Sistema de Automatización de Estaciones de Servicio 2.9.1 en Linux contiene una vulnerabilidad de inyección SQL (CWE-89) en el módulo de configuración del sistema. Un atacante remoto puede enviar solicitudes HTTP POST especialmente diseñadas al endpoint /php/request.php a través del parámetro sql en datos application/x-www-form-urlencoded (e.g., action=do&amp;sql=&amp;reload_driver=0) para ejecutar comandos SQL arbitrarios y potencialmente lograr ejecución remota de código.

10 Mar 2026, 18:19

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:19

Updated : 2026-05-07 20:34

NVD link : CVE-2026-3843

Mitre link : CVE-2026-3843

CVE.ORG link : CVE-2026-3843

JSON object : View

Products Affected

bukts

  • buk_ts-g_gas_station_automation_system

linux

  • linux_kernel
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')