Lucene search
PRIOn knowledge basePRION:CVE-2022-3323HistorySep 27, 2022 - 11:15 p.m.
Sql injection
2022-09-2723:15:00
PRIOn knowledge base
www.prio-n.com
7
sql injection
advantech iview
configurationservlet
tcp port 8080
unauthenticated remote attacker
bypass checks
com.imc.iview.utils.cutils.checksqlinjection()
iview admin password
An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.
| CPE | Name | Operator | Version |
|---|---|---|---|
| iview | eq | 5.7.04.6469 |
Related
cvelist
cvelist
CVE-2022-3323
2022-09-27 13:51:02
nessus
nessus
Advantech iView ConfigurationServlet SQLi (CVE-2022-3323)
2023-01-03 00:00:00
cnvd
cnvd
Advantech iView SQL Injection Vulnerability
2022-09-29 00:00:00
cve
cve
CVE-2022-3323
2022-09-27 23:15:15
ics
ics
Advantech iView
2022-12-08 12:00:00
nvd
nvd
CVE-2022-3323
2022-09-27 23:15:15