DescriptionDelta Electronics DIAEnergie before 1.11.00.022 contains a SQL injection vulnerability in the settings group-list action that allows remote authenticated attackers to manipulate database contents by injecting unsanitized input through the hid parameter, which is concatenated directly into a single-quoted WHERE subquery without parameterization or escaping. Attackers can leverage time-based and stacked-query payloads through the permissive global request filter to read, modify, and delete database contents, and escalate to operating-system command execution when the configured database account is sufficiently privileged.