CVE-2026-3843: SQL Injection in Nefteprodukttekhnika BUK TS-G Allows Remote Code Execution

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-10 · updated 2026-08-10
Weakness: CWE-89

Description

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.

Affected products

Nefteprodukttekhnika LLC BUK TS-G Gas Station Automation System: from 2.9.1 before 2.10.2 — fixed in 2.10.2

How to fix

Upgrade to a fixed version: Nefteprodukttekhnika LLC BUK TS-G Gas Station Automation System 2.10.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-3843 or the next vulnerability affects your stack