CVE-2022-3323

An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.tenable.com/security/research/tra-2022-32	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:advantech:iview:5.7.04.6469:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-09-27 23:15

Updated : 2022-09-29 16:41

NVD link : CVE-2022-3323

Mitre link : CVE-2022-3323

CVE.ORG link : CVE-2022-3323

JSON object : View

Products Affected

advantech

iview

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2022-3323", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-09-27T23:15:15.867", "references": [{"url": "https://www.tenable.com/security/research/tra-2022-32", "tags": ["Exploit", "Third Party Advisory"], "source": "vulnreport@tenable.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n SQL en Advantech iView versi\u00f3n 5.7.04.6469. La falla espec\u00edfica se presenta dentro del endpoint ConfigurationServlet, que escucha en el puerto TCP 8080 por defecto. Un atacante remoto no autenticado puede dise\u00f1ar un par\u00e1metro column_value especial en la acci\u00f3n setConfiguration para omitir las comprobaciones de com.imc.iview.utils.CUtils.checkSQLInjection() y llevar a cabo una inyecci\u00f3n SQL. Por ejemplo, el atacante puede explotar la vulnerabilidad para recuperar la contrase\u00f1a de administrador de iView"}], "lastModified": "2022-09-29T16:41:35.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:advantech:iview:5.7.04.6469:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E39B345-0A1D-4908-B715-8549878F73FF"}], "operator": "OR"}]}], "sourceIdentifier": "vulnreport@tenable.com"}