CVE-2018-7765 is a high-severity SQL injection vulnerability (CWE-89) affecting Schneider Electric U.motion Builder software versions prior to v1.3.4. Specifically, the track_import_export.php component is vulnerable to SQL injection via the object_id input parameter. This flaw carries a CVSS v3 score of 8.8, indicating a critical risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability impacts. While there is no evidence of active exploitation (not in KEV), a Nuclei template exists for detection, and the vulnerability has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.3.4CPE matchmatch criteria | cpe:2.3:a:schneider-electric:u.motion_builder:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.