Aller au contenu
en Se connecter
7.5 Élevée

CVE-2022-3323 An SQL injection vulnerability in Advantech iView 5.7.04.6469

Description

An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.

Produits et versions touchés

Produit Versions touchées Corrigé en
Advantech iView Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Advantech iView

Les 13 CVE de Advantech iView →
CVE-2023-3983 An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752 Non notée CVE-2021-22652 Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow… Non notée CVE-2021-22656 Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to… Non notée CVE-2021-22658 Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to… Non notée
Suivre cette CVE