Authenticated Blind SQL Injection in ScadaLTS

ScadaLTS version 2.8.1-rc is susceptible to an authenticated blind SQL injection vulnerability, identified as CVE-2026-84859. The flaw exists within the /api/events/search endpoint, which processes a JSON body containing a sortBy array. Because these array values are concatenated directly into a SQL ORDER BY clause without adequate sanitization or parameterization, an attacker can manipulate database queries. Any user with low-level privileges, including the ROLE_USER role, can leverage time-based or boolean-based SQL injection techniques to extract arbitrary information from the backend database. This impact includes the potential theft of user password hashes, which facilitates further unauthorized access or account takeover. Defenders must monitor API traffic for anomalous patterns originating from authenticated accounts and prioritize patching or isolating instances running the 2.8.1-rc build.

Impact

Successful exploitation grants an authenticated attacker unauthorized read access to the ScadaLTS database. This enables the exfiltration of sensitive information, specifically user credential hashes, which could lead to wider system compromise across the Industrial Control System (ICS) environments where ScadaLTS is deployed.

Recommendation

• Monitor webserver access logs for anomalous JSON payloads targeting the /api/events/search endpoint.
• Audit user roles and limit access to API endpoints to only necessary personnel to reduce the surface area for this authenticated exploit.
• Review all database query patterns for evidence of SQL injection, specifically looking for unusual characters or SQL syntax (e.g., SLEEP, UNION, CASE) within the sortBy array parameters.
• Patch or upgrade ScadaLTS to a version beyond 2.8.1-rc once a vendor-provided secure version is released.