PT-2018-16960 · Advantech · Webaccess/Scada

Rgod · Published 2018-01-25 · Updated 2019-10-09 · CVE-2018-5443

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/SCADA versions prior to V8.2 20170817

Description A SQL Injection issue was discovered in the software. It does not properly sanitize its inputs for SQL commands, which can lead to information disclosure. The issue is related to the uMailLogin and chkLogin2 functions, where the user variable is vulnerable to SQL injection.

Recommendations For versions prior to V8.2 20170817, update to version V8.2 20170817 or later to resolve the issue. As a temporary workaround, consider restricting access to the uMailLogin and chkLogin2 functions to minimize the risk of exploitation. Avoid using the user variable in affected API endpoints until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-5443

ZDI-18-143

ZDI-18-144

Affected Products

Webaccess/Scada

References · 6

• https://zerodayinitiative.com/advisories/ZDI-18-144 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5443 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-143 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-5443 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-023-01 · Note
• http://securityfocus.com/bid/102781 · Note