Yergashvoyev Jamshed

**Name of the Vulnerable Software and Affected Versions** Nefteprodukttekhnika BUK TS-G Gas Station Automation System version 2.9.1 **Description** The system configuration module contains a SQL Injection flaw. A remote attacker can send specially crafted HTTP POST requests to the '/php/request.php' endpoint using the `sql` parameter within application/x-www-form-urlencoded data to execute arbitrary SQL commands. This could lead to unauthorized access to protected information and potentially result in remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `sql` parameter in the '/php/request.php' endpoint to minimize the risk of exploitation.