CVE-2017-16716
Advantech WebAccess BWSCADASoap Login Method SQL Injection Authentication Bypass Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A SQL Injection issue was discovered in WebAccess versions prior to 8.3. WebAccess does not properly sanitize its inputs for SQL commands.
Se ha descubierto un problema de inyección SQL en WebAccess en versiones anteriores a la 8.3. WebAccess no sanea adecuadamente sus entradas para comandos SQL.
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Advantech WebAccess.
The specific flaw exists within processing of the Login method of the BWSCADASoap entry point. When parsing the ProjectName and Username elements, the process does not properly validate user-supplied strings before using them to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the database.
Advantech WebAccess version 8.0-2015.08.16 suffers from a remote SQL injection vulnerability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-11-09 CVE Reserved
- 2018-01-05 CVE Published
- 2024-05-22 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/102424 | Third Party Advisory | |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-004-02 | Broken Link |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/43928 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|