CVE-2017-14851

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-03 · updated 2026-06-17
Weakness: CWE-89

Description

A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25. The vulnerability is in the login page, where the authentication validation process contains an insecure SELECT query. The attack allows for authentication bypass.

Affected products

Orpak Siteomat: before 6.4.414.084 — fixed in 6.4.414.084

How to fix

Upgrade to a fixed version: Orpak Siteomat 6.4.414.084. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/108167
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01
https://www.orpak.com
http://www.securityfocus.com/bid/108167
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01
https://www.orpak.com

Get alerted when CVE-2017-14851 or the next vulnerability affects your stack