A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an…

published 2019-05-22 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-19553

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-04-15
epss: 72.5%; EPSS 72.5% chance of exploitation in 30 days, percentile 99.4%
public exploits: 1; Exploit-DB, plus a Nuclei check

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Patch / fix

cisa required action The impacted product is end-of-life and should be disconnected if still in use.

Timeline

2019-05-14 First public exploit (EDB-46846)
2019-05-22 Published
2022-04-15 Added to CISA KEV
2022-05-06 CISA patch deadline
2025-02-07 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-04-15)
Patch by: 2022-05-06 (4 y ago)
Ransomware: Not known
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Vendor, product: Schneider Electric, U.motion Builder
CISA name: Schneider Electric U.motion Builder SQL Injection Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 21 mo ago (2025-02-07)

Exploit prediction

72.49% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-46846 Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injection webapps, 2019-05-14
Nuclei template Schneider Electric U.motion Builder - Remote Code Execution nuclei detection template
packetstormsecurity.com http://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html referenced PoC, tagged "exploit" by a source, unverified
seclists.org http://seclists.org/fulldisclosure/2019/May/26 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

U.motion U.motion Builder software version 1.3.4

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

packetstormsecurity.com /files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html
exploit, third-party-advisory, vdb-entry
seclists.org /fulldisclosure/2019/May/26
mailing-list, exploit, third-party-advisory
schneider-electric.com /ww/en/download/document/SEVD-2019-071-02
vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7841
government-resource, us-government-resource

Sources

CVE List CVE-2018-7841
NVD CVE-2018-7841

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary