CVE-2022-3323

An SQL injection vulnerability in Advantech iView 5.7.04.6469

High · published September 27, 2022

CVSS v3.1

7.5

EPSS

29%

Percentile

98.2

In the wild

Unconfirmed

What it is

An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.29312 · 98.2th percentile
Published: 2022-09-27T13:51Z

EPSS history

Timeline

27 SEP 13:51Z
An SQL injection vulnerability in Advantech iView 5.7.04.6469
cvelistv5