PT-2018-5455 · Moxa · Moxa Softcms Live Viewer

Published 2018-01-18 · Updated 2019-10-09 · CVE-2017-12729

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Moxa SoftCMS Live Viewer versions 1.6 and earlier

Description: A SQL Injection issue has been discovered, allowing attackers to exploit an improper neutralization of special elements used in an SQL command. This enables access to SoftCMS without knowing the user's password.

Recommendations: For Moxa SoftCMS Live Viewer versions 1.6 and earlier, consider restricting access to the SQL database to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using user input in SQL commands to prevent injection attacks.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-12729

Affected Products

Moxa Softcms Live Viewer

References · 3

• https://osv.dev/vulnerability/CVE-2017-12729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12729 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-243-05 · Note