CVE-2017-7973

CVE-2017-7973 is a critical SQL injection vulnerability affecting Schneider Electric's U.motion Builder software versions 1.2.1 and prior. An unauthenticated attacker can exploit this flaw by making calls to various paths, enabling the execution of arbitrary SQL commands against the underlying database. With a CVSS score of 9.8 (CRITICAL), this vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and high potential for compromise of confidentiality, integrity, and availability. While there is no known active exploitation or publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered substantial community discussion with over 10 mentions, indicating awareness among security researchers.