PT-2023-4022 · Advantech · Advantech Iview

Publicado 2023-07-31 · Atualizado 2023-08-04 · CVE-2023-3983

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to v5.7.4 build 6752

Description An authenticated SQL injection issue exists, allowing a remote attacker to bypass checks in the checkSQLInjection() function to perform blind SQL injection. This can enable the attacker to execute arbitrary SQL commands. The vulnerability is related to the lack of protection for the SQL query structure.

Recommendations For versions prior to v5.7.4 build 6752, update to version v5.7.4 build 6752 or later to resolve the issue. As a temporary workaround, consider disabling the checkSQLInjection() function in com.imc.iview.utils.CUtils until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-04320

CVE-2023-3983

Produtos afetados

Advantech Iview

Referências · 6

• 🔥 https://tenable.com/security/research/tra-2023-24 · Exploit
• https://t.me/cibsecurity/67489 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3983 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-3983 · Nota de Segurança
• https://advantech.com/en/support/details/firmware?id=1-HIPU-183 · Nota
• https://bdu.fstec.ru/vul/2023-04320 · Nota de Segurança