CVE-2014-0763 Advantech WebAccess SQL Injection
HighCVSS 7.5
EPSS 15.6%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
An attacker using SQL injection may use arguments to construct queries
without proper sanitization. The DBVisitor.dll is exposed through SOAP
interfaces, and the exposed functions are vulnerable to SOAP injection.
This may allow unexpected SQL action and access to records in the table
of the software database or execution of arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| advantech webaccess | <= 7.1 | No fix listed |
| advantech webaccess | = 5.0 | No fix listed |
| advantech webaccess | = 6.0 | No fix listed |
| advantech webaccess | = 7.0 | No fix listed |
References
- webaccess.advantech.com
- 66740 vdb-entry
- www.cisa.gov
- ics-cert.us-cert.gov us-government-resource