Suprema BioStar 2

An attacker with login credentials could inject SQL commands into BioStar 2 to read sensitive data from the access control database, such as employee credentials, biometric data, or access logs. This could compromise physical security by exposing authentication records or enabling further system manipulation.

This affects organizations using Suprema BioStar 2 for physical access control, particularly in facilities requiring multi-factor biometric authentication such as government buildings, corporate offices, data centers, and utility control rooms. Anyone managing access control systems who relies on BioStar 2 databases should treat this as a credential and data protection risk.

An attacker must first authenticate to the BioStar 2 web interface using valid credentials (obtained through phishing, credential stuffing, or default credentials if unchanged). Once logged in, the attacker submits a crafted SQL injection payload through an input field to execute arbitrary SQL queries and extract or modify database contents.