Contec CONPROSYS HMI System (CHS) Unauthenticated SQLi

There is an SQL injection vulnerability in Contec CONPROSYS HMI System (CHS) 3.5.1. An unauthenticated remote attacker can exploit it to enumerate a CHS database.

CHS logs login attempts to the dbo.m_user_login table in a PostgreSQL database:

from: auth_login.php 
<...snip...>
    $v = d5::v(); // get client IP address
    if ($l != null) {
        $p = ad(time());
        $q = new d5($i, null, null, 'dbo.m_user_login');
        try {
            $q->_a(_S34_, "'" . $o . "','" . $l->l …