A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/100526 | Third Party Advisory VDB Entry |
| http://www.zerodayinitiative.com/advisories/ZDI-17-712/ | |
| https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02 | Third Party Advisory US Government Resource |
| https://www.tenable.com/security/research/tra-2017-29 | |
| http://www.securityfocus.com/bid/100526 | Third Party Advisory VDB Entry |
| http://www.zerodayinitiative.com/advisories/ZDI-17-712/ | |
| https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02 | Third Party Advisory US Government Resource |
| https://www.tenable.com/security/research/tra-2017-29 |
Configurations
History
21 Nov 2024, 03:10
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/100526 - Third Party Advisory, VDB Entry | |
| References | () http://www.zerodayinitiative.com/advisories/ZDI-17-712/ - | |
| References | () https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02 - Third Party Advisory, US Government Resource | |
| References | () https://www.tenable.com/security/research/tra-2017-29 - |
Information
Published : 2017-08-30 18:29
Updated : 2024-11-21 03:10
NVD link : CVE-2017-12710
Mitre link : CVE-2017-12710
CVE.ORG link : CVE-2017-12710
JSON object : View
Products Affected
advantech
- webaccess
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')