Cgs1234

**Name of the Vulnerable Software and Affected Versions** Wanzhou WOES Intelligent Optimization Energy Saving System version 1.0 **Description** A critical vulnerability exists in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0, specifically within the Environmental Real-Time Data Module. The vulnerability is a SQL injection, triggered by manipulating the `energyId` argument in the `/WEAS HomePage/GetAreaTrendChartData` API endpoint. This allows for remote attacks. The exploit for this issue has been publicly disclosed. **Recommendations** As a temporary workaround, restrict access to the `/WEAS HomePage/GetAreaTrendChartData` API endpoint. Sanitize the `energyId` argument to prevent SQL injection.

**Name of the Vulnerable Software and Affected Versions** Wanzhou WOES Intelligent Optimization Energy Saving System version 1.0 **Description** A critical issue exists in the Analysis Conclusion Query Module of Wanzhou WOES Intelligent Optimization Energy Saving System. The vulnerability is due to improper processing of the `resultId` argument within the `/WEAS AlarmResult/GetAlarmResultProcessList` endpoint, leading to a SQL injection. This allows for remote manipulation of alarm data, potentially enabling attackers to spoof or silence alarms. **Recommendations** Versions prior to 1.0 should be used. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wanzhou WOES Intelligent Optimization Energy Saving System version 1.0 **Description** A critical vulnerability exists in the Energy Overview Module of Wanzhou WOES Intelligent Optimization Energy Saving System. The manipulation of the `BP ProID` argument in the `/WEAS HomePage/GetTargetConfig` API endpoint leads to a SQL injection. This allows for remote attacks. The exploit has been publicly disclosed. **Recommendations** As a temporary workaround, restrict access to the `/WEAS HomePage/GetTargetConfig` API endpoint until a fix is available. Sanitize the `BP ProID` argument to prevent SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** Wanzhou WOES Intelligent Optimization Energy Saving System version 1.0 **Description** A critical vulnerability exists in the Energy Overview Module of the Wanzhou WOES Intelligent Optimization Energy Saving System. The vulnerability is due to a SQL injection flaw within the `/CommonSolution/CreateFunctionLog` file. Manipulation of the `MM MenID` argument allows for remote exploitation. The exploit for this issue has been publicly disclosed. **Recommendations** As a temporary workaround, consider restricting access to the `/CommonSolution/CreateFunctionLog` file until a patch is available. Sanitize the `MM MenID` argument to prevent SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** Wanzhou WOES Intelligent Optimization Energy Saving System version 1.0 **Description** A vulnerability exists in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. The issue involves SQL injection due to the manipulation of the `optUser` argument within the `/OL OprationLog/GetPageList` file. This allows for remote attacks. The exploit for this issue has been publicly disclosed. **Recommendations** As a temporary workaround, consider restricting access to the `/OL OprationLog/GetPageList` file to minimize the risk of exploitation. Sanitize the `optUser` argument to prevent SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** Wanzhou WOES Intelligent Optimization Energy Saving System version 1.0 **Description** A critical issue exists in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0, specifically within the Historical Data Query Module. The vulnerability is a SQL injection, triggered by manipulating the `ObjectID` argument in the `/CommonSolution/GetVariableByOneIDNew` file. This allows for remote exploitation. The exploit details have been publicly disclosed. **Recommendations** As a temporary workaround, consider restricting access to the `/CommonSolution/GetVariableByOneIDNew` file to minimize the risk of exploitation. Sanitize the `ObjectID` argument to prevent SQL injection attacks.