JSON-SCADA: SQL injection in OPC HistoryRead API
Summary
JSON-SCADA versions before 0.65-alpha contain an SQL injection flaw in the OPC HistoryRead API handled by opcApi(). An authenticated user can inject stacked SQL statements through the NodeId.Id, StartTime or EndTime parameters. This can allow reading, modifying or deleting historian data across all locations, regardless of role.
Affected
- json-scada from 0 to before 0.65-alpha
- Vulnerable component: src/server_realtime_auth/index.js (opcApi)
Fixed in
- Upgrade to json-scada 0.65-alpha or later (vendor release V0.65-alpha)
- Note: 0.65-alpha is a pre-release; the vendor release notes were not reviewed in detail
Workaround
- No vendor workaround known. Unknown.
- Restrict access to the JSON-SCADA web/API and historian interfaces to management networks or VPN
- Review accounts with API access
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total
- No public exploit or in-the-wild exploitation found in the research
- Not verified against the CISA KEV catalogue
Our recommendation
- Check whether JSON-SCADA is in use and which versions are deployed
- Check whether the web or API ports are reachable from outside the OT or internal network; if so, treat as high priority
- Restrict access to the web/API and historian interfaces and review API accounts
- Back up the historian database, then upgrade to 0.65-alpha after checking the release notes and upgrade procedure with the vendor
- Review logs for unusual HistoryRead requests and change default credentials
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Vendor fix commit github.com
- Vendor release V0.65-alpha github.com
- Vulnerable code V0.64-alpha github.com
- VulDB vuldb.com
- CVE mirror cvefeed.io cvefeed.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:46.
Original description (NVD)
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.
NVD references (5)
- https://github.com/riclolsen/json-scada
- https://github.com/riclolsen/json-scada/blob/V0.64-alpha/src/server_realtime_auth/index.js#L2175-L2224
- https://github.com/riclolsen/json-scada/commit/60b65bcd42d6ee21aa8587580ec778c3bb9b4755
- https://github.com/riclolsen/json-scada/releases/tag/V0.65-alpha
- https://www.vulncheck.com/advisories/json-scada-before-0.65-alpha-sql-injection-via-opc-historyread-api
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.