SQLi Vulnerability in TREX-MES-Applications (CVE-2026-18782)

Overview

TREX MES is a commercial Manufacturing Execution System (MES) / Industry 4.0 platform used to collect and manage data from the production floor. The application's web API executes the client-supplied sql parameter directly on the backend Microsoft SQL Server and returns the result set as JSON.

Impact

A low-privileged authenticated user — or any attacker who obtains a session token through the authentication bypass described below — can:

• Read, modify, or delete data in all databases on the SQL Server instance. This is not limited to the application's own database; it also covers production, finance, and personnel databases.
• Obtain stored user credentials. Passwords are not hashed; they are stored with a character-based and trivially reversible shift, so all account passwords can be recovered in plaintext.
• Execute arbitrary operating system commands in the context of the SQL Server service account via xp_cmdshell. In the tested installation, this account holds the SeImpersonatePrivilege privilege, which allows escalation to NT AUTHORITY\SYSTEM and full compromise of the server, providing a foothold for lateral movement into the internal network.

Since the affected system is a manufacturing execution platform, the ability to silently alter production and quality records carries an operational and business continuity risk beyond conventional IT impact.

Related Weaknesses

The same API's login flow selects the Password column and returns it to the browser, and the password comparison is performed client-side. Combined with the query vulnerability above, a UNION-based statement sent through the username field makes it possible to inject a synthetic record with an attacker-chosen password and admin flag, resulting in a full authentication bypass without knowledge of any valid credentials. This behavior was verified in the tested installation.

• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
• CWE-602 — Client-Side Enforcement of Server-Side Security
• CWE-522 — Insufficiently Protected Credentials
• CWE-250 — Execution with Unnecessary Privileges

Severity

Critical — CVSS 3.1 Base Score 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Affected Versions

trex MES v.6.07.17.00090 and earlier

TrexDCAS MES v.6.05.14.00074 and earlier

Affected Component

/api/GetDataJSON3 and /api/GetDataJSONCrypto3 — the client-supplied sql parameter handling logic in the web service layer

Mitigations

Until the vendor releases a fix, operators are advised to implement the following:

1. Block both endpoints at the reverse proxy or WAF layer. The vulnerability is architectural and cannot be remediated through input filtering.
2. Disable the xp_cmdshell feature (sp_configure 'xp_cmdshell', 0) and review other components that enable command execution, such as OLE Automation Procedures and CLR integration.
3. Remove the sysadmin role from the application's database account and grant only the minimum required object-level permissions.
4. Reset the passwords of all application users; stored credentials must be considered recoverable.
5. Restrict network access to the application and database ports to only the systems that require it.

For a permanent fix, the vendor must move query construction to the server side using parameterized statements, perform authentication on the server, and store passwords using a salted, computationally expensive hash algorithm.

CVE ID

CVE-2026-18782

Month

Hasan Hüseyin UYAR – Netlore Security

Disclosure Timeline

Date	Event
2026-07-30	The vulnerability was detected and verified during an authorized penetration test
2026-08-04	CVE-2026-18782 ID was assigned.
2026-09-30	Published with the ID https://www.cve.org/CVERecord?id=CVE-2026-18782.