PT-2021-6947 · Advantech · Advantech R-Seenet

Yuri Kramarz · Published 2021-08-19 · Updated 2022-05-13 · CVE-2021-21917

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet version 2.4.15

Description The issue is related to a SQL injection vulnerability in the 'group list' page. It is caused by the lack of protection against SQL query structure manipulation through the ord parameter. An attacker can exploit this by making specially crafted HTTP requests, potentially allowing the execution of arbitrary SQL queries. This can be triggered by any authenticated user or through cross-site request forgery.

Recommendations For Advantech R-SeeNet version 2.4.15, consider disabling access to the 'group list' page or restricting the use of the ord parameter until a patch is available. Additionally, restrict access to authenticated HTTP requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2022-02718

CVE-2021-21917

Affected Products

Advantech R-Seenet

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1363 · Exploit
• https://safe-surf.ru/upload/VULN/VULN-20211124.3.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2021-21917 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21917 · Security Note
• https://bdu.fstec.ru/vul/2022-02718 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021112314 · Note