CVE-2014-0763 Advantech WebAccess SQL Injection
SQL injection in Advantech WebAccess allows attackers to access database records or execute arbitrary code via SOAP interfaces.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-0763?
CVE-2014-0763 is a high-severity SQL injection vulnerability in Advantech WebAccess, published on 12 Apr 2014. It can be exploited over the network, with no action from the victim.
Official description
An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. This may allow unexpected SQL action and access to records in the table of the software database or execution of arbitrary code.
Weakness: CWE-89
Which versions are affected by CVE-2014-0763?
It affects 1 product.
Products include Advantech Advantech Webaccess.
How do I fix CVE-2014-0763?
No fix has been published for CVE-2014-0763 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2014-0763 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-0763 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Advantech WebAccess
- CVE-2011-4524 Buffer overflow in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via a long string value in unspecified parameters.
- CVE-2011-4525 Code injection in n/a
- CVE-2011-4526 Memory corruption in n/a
- CVE-2012-0238 Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors.
- CVE-2012-0240 Auth bypass in n/a
Sources
Also known as GHSA-9cmf-7pgf-j9g9.