CVE-2026-3843 is a critical SQL Injection vulnerability (CWE-89) affecting Nefteprodukttekhnika LLC's BUK TS-G Gas Station Automation System version 2.9.1 on Linux. The flaw exists in the system configuration module where the sql parameter in HTTP POST requests to /php/request.php is improperly sanitized, allowing remote attackers to execute arbitrary SQL commands. This can potentially lead to remote code execution and full system compromise. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, and remote code execution. This compromises the confidentiality, integrity, and availability of the affected system, posing a critical risk to gas station automation operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected endpoint and monitor for suspicious HTTP POST requests targeting the sql parameter. Avoid exposing the system directly to untrusted networks.