PT-2023-4022 · Advantech · Advantech Iview

Published 2023-07-31 · Updated 2023-08-04 · CVE-2023-3983

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to v5.7.4 build 6752

Description An authenticated SQL injection issue exists, allowing a remote attacker to bypass checks in the checkSQLInjection() function to perform blind SQL injection. This can enable the attacker to execute arbitrary SQL commands. The vulnerability is related to the lack of protection for the SQL query structure.

Recommendations For versions prior to v5.7.4 build 6752, update to version v5.7.4 build 6752 or later to resolve the issue. As a temporary workaround, consider disabling the checkSQLInjection() function in com.imc.iview.utils.CUtils until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-04320

CVE-2023-3983

Affected Products

Advantech Iview

References · 6

• 🔥 https://tenable.com/security/research/tra-2023-24 · Exploit
• https://osv.dev/vulnerability/CVE-2023-3983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3983 · Security Note
• https://bdu.fstec.ru/vul/2023-04320 · Security Note
• https://t.me/cibsecurity/67489 · Telegram Post
• https://advantech.com/en/support/details/firmware?id=1-HIPU-183 · Note