CVE-2019-10123: AIS ESEL-Server SQL injection allows anonymous code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required, default 'sa' database privileges, and public exploit tooling make this a severe, easily reachable flaw.

What it is

Advanced InfoData Systems ESEL-Server 67, the backend for the AIS logistics mobile app, is vulnerable to SQL injection. An unauthenticated attacker can inject SQL and execute arbitrary code in the context of the MSSQL database user, which by default is the highly privileged 'sa' account. This exposes the backend database and any data or host access that account holds.

Impact

An anonymous attacker gains arbitrary code execution as the MSSQL 'sa' user, effectively full control of the database and potentially the underlying server. This can lead to data theft, tampering, or further lateral movement.

Attack surface

The flaw is reachable over the network with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. It is exposed through the ESEL-Server backend that serves the AIS logistics mobile app.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.6585 (99.2nd percentile) and references include a Metasploit pull request tagged Exploit, indicating public exploit tooling exists. No ransomware group usage is documented.

What to do

• Apply the vendor fix or upgrade from AIS ESEL-Server 67; check ais.de for current guidance.
• If patching is not immediately possible, restrict network access to the ESEL-Server backend to trusted hosts only.
• Change the MSSQL 'sa' account password and disable or rename it where feasible; do not run the service under 'sa'.
• Apply least privilege to the database account used by ESEL-Server and enable SQL logging and alerting.
• Monitor for and block SQL injection patterns at the web/application layer in front of the backend.

Detection

• Review MSSQL logs for unexpected queries, errors, or xp_cmdshell and other extended procedure usage.
• Alert on database connections and queries originating from the ESEL-Server backend outside normal application patterns.
• Hunt for Metasploit or SQL injection payload strings in HTTP requests to the AIS logistics backend.
• Monitor for new processes or outbound connections spawned by the MSSQL service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.