CVE-2026-115328 in Json-Scada
Summary
by MITRE • 10/22/2026
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in JSON-SCADA versions prior to 0.65-alpha represents a critical security flaw within the server-side authentication and real-time processing module. Specifically located in the opcApi function found at src/server_realtime_auth/index.js, this issue stems from improper neutralization of special elements used in SQL commands. The root cause is a failure to properly sanitize or parameterize user-supplied input when constructing database queries for historical data retrieval operations. This lack of input validation allows an attacker who has already authenticated into the system to manipulate the underlying Structured Query Language statements executed by the application server.
The operational impact of this vulnerability is severe due to its broad scope and potential for data integrity compromise. Because the injection occurs within the HistoryReadRequest parameters, specifically through fields such as NodeId.Id, StartTime, or EndTime, an authenticated user can inject stacked SQL statements. Stacked queries allow multiple commands to be executed in a single request, which significantly expands the attack surface beyond simple data exfiltration. An attacker could potentially read sensitive historian data from all locations within the SCADA environment, regardless of their assigned role permissions. Furthermore, the ability to modify or delete this historical data poses a direct threat to operational continuity and forensic analysis capabilities, as critical logs and performance metrics can be altered or erased to cover tracks or disrupt monitoring systems.
From a classification perspective, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The ability to execute stacked statements further exacerbates the risk, potentially leading to unauthorized privilege escalation if subsequent queries can modify user roles or access controls within the database schema. In terms of tactical mapping, this exploit falls under MITRE ATT&CK technique T1059, specifically command scripting via JavaScript Node.js environments, and relates to data exfiltration techniques such as T1005 where sensitive information is collected from local system resources without direct network communication during the initial phase.
Mitigation strategies must focus on immediate remediation of the codebase and enhanced input validation practices. The primary fix involves upgrading JSON-SCADA to version 0.65-alpha or later, where this specific flaw has been addressed by developers through proper parameterization of SQL queries. For systems that cannot be immediately upgraded, implementing strict allow-listing for NodeId.Id values and enforcing type checking on StartTime and EndTime fields can reduce the risk of successful injection attempts. Additionally, deploying a Web Application Firewall with rules tuned to detect stacked query patterns may provide an additional layer of defense against exploitation while permanent patches are applied. Regular security audits focusing on database interaction layers in industrial control system software are essential to prevent similar vulnerabilities from persisting in critical infrastructure environments.