CVE-2026-3843: BUK TS-G Gas Station System SQLi Flaw

CVE-2026-3843 Overview

CVE-2026-3843 is a critical SQL Injection vulnerability (CWE-89) affecting the Nefteprodukttekhnika BUK TS-G Gas Station Automation System version 2.9.1 running on Linux. The vulnerability exists in the system configuration module, specifically within the /php/request.php endpoint. A remote attacker can exploit this flaw by sending specially crafted HTTP POST requests with malicious SQL commands via the sql parameter, potentially leading to arbitrary SQL command execution and remote code execution.

Critical Impact

This SQL Injection vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database, potentially compromising sensitive operational data, system integrity, and enabling remote code execution on gas station automation infrastructure.

Affected Products

• Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1
• Linux-based BUK TS-G deployments with exposed /php/request.php endpoint
• Gas station automation systems utilizing the vulnerable configuration module

Discovery Timeline

• 2026-03-10 - CVE-2026-3843 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-3843

Vulnerability Analysis

This vulnerability represents a classic SQL Injection flaw resulting from improper input validation in the system configuration module. The /php/request.php endpoint accepts user-controlled input through the sql parameter without adequate sanitization or parameterized query implementation. This architectural weakness allows attackers to inject arbitrary SQL statements directly into database queries processed by the backend system.

The attack surface is particularly concerning given the critical infrastructure nature of gas station automation systems. Successful exploitation could allow attackers to read, modify, or delete database records containing operational data, customer information, fuel inventory levels, and system configurations. In worst-case scenarios, attackers may leverage database-specific features such as xp_cmdshell (SQL Server) or LOAD_FILE/INTO OUTFILE (MySQL) to achieve remote code execution on the underlying operating system.

Root Cause

The root cause of CVE-2026-3843 is the direct concatenation of user-supplied input from the sql parameter into SQL queries without proper input validation, sanitization, or the use of parameterized queries (prepared statements). The application processes HTTP POST requests with application/x-www-form-urlencoded content type and passes the sql parameter value directly to the database engine.

This design flaw violates fundamental secure coding practices for database interaction, specifically:

• Absence of input validation and sanitization routines
• Failure to implement parameterized queries or prepared statements
• Lack of principle of least privilege for database user accounts
• Missing web application firewall rules to filter malicious SQL patterns

Attack Vector

The vulnerability is exploited via network-based attacks requiring no authentication or user interaction. An attacker sends a crafted HTTP POST request to the /php/request.php endpoint with malicious content in the sql parameter. The request format follows the application/x-www-form-urlencoded content type with parameters structured as action=do&sql=<malicious_query>&reload_driver=0.

The attack can be performed remotely against any exposed BUK TS-G system. Attackers may leverage techniques such as UNION-based injection to exfiltrate data, stacked queries to execute multiple statements, or database-specific functions to escalate from SQL injection to full system compromise. The lack of authentication requirements significantly lowers the barrier to exploitation.

Detection Methods for CVE-2026-3843

Indicators of Compromise

• HTTP POST requests to /php/request.php containing SQL keywords in the sql parameter such as UNION, SELECT, INSERT, UPDATE, DELETE, DROP, or --
• Unusual database query patterns or error messages in application logs indicating injection attempts
• Unexpected database modifications, data exfiltration, or new administrative accounts
• Web server access logs showing repeated requests to the vulnerable endpoint with varying payloads

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block SQL injection patterns targeting the /php/request.php endpoint
• Implement database activity monitoring to alert on anomalous queries or unauthorized data access patterns
• Configure intrusion detection systems (IDS) with signatures for common SQL injection payloads and techniques
• Enable verbose logging on the BUK TS-G system to capture all requests to the configuration module

Monitoring Recommendations

• Monitor network traffic for HTTP POST requests to /php/request.php with suspicious sql parameter values
• Set up alerts for database authentication failures, privilege escalation attempts, or execution of administrative commands
• Review web server and application logs regularly for patterns consistent with SQL injection reconnaissance or exploitation
• Implement real-time security information and event management (SIEM) correlation rules for SQL injection attack detection

How to Mitigate CVE-2026-3843

Immediate Actions Required

• Restrict network access to the BUK TS-G web interface to trusted IP addresses only using firewall rules
• Disable or remove the /php/request.php endpoint if it is not required for operations
• Deploy a web application firewall with SQL injection protection rules in front of affected systems
• Audit database accounts used by the application and apply principle of least privilege

Patch Information

Organizations should consult the vendor Nefteprodukttekhnika for official security patches or updated firmware for the BUK TS-G Gas Station Automation System. Additional information may be available through the FSTEC Vulnerability Report 2025-13914 and the Bukts Repository Overview.

Workarounds

• Implement network segmentation to isolate gas station automation systems from untrusted networks and the public internet
• Configure reverse proxy or WAF rules to filter requests containing SQL injection patterns before they reach the application
• Apply input validation at the network perimeter level to sanitize or reject requests with suspicious sql parameter content
• Consider disabling the vulnerable endpoint entirely until an official patch is available from the vendor

# Example: iptables rule to restrict access to BUK TS-G web interface
iptables -A INPUT -p tcp --dport 80 -s <trusted_ip_range> -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

# Example: Block requests to vulnerable endpoint at web server level (Apache)
# Add to .htaccess or Apache configuration
<Location "/php/request.php">
    Require ip <trusted_ip_range>
</Location>