cve/2024/CVE-2024-4547.md

### [CVE-2024-4547](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4547)
![](https://img.shields.io/static/v1?label=Product&message=DIAEnergie&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%3D%201.10.1.8610%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%20Improper%20Input%20Validation&color=brighgreen)

### Description

A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field

### POC

#### Reference
- https://www.tenable.com/security/research/tra-2024-13
- https://www.tenable.com/security/research/tra-2024-13

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds