CVE-2026-3843

Name of the Vulnerable Software and Affected Versions Nefteprodukttekhnika BUK TS-G Gas Station Automation System version 2.9.1

Description The system configuration module contains a SQL Injection flaw. A remote attacker can send specially crafted HTTP POST requests to the '/php/request.php' endpoint using the sql parameter within application/x-www-form-urlencoded data to execute arbitrary SQL commands. This could lead to unauthorized access to protected information and potentially result in remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the sql parameter in the '/php/request.php' endpoint to minimize the risk of exploitation.