Advantech WebAccess/VPN SQL Injection Vulnerability in AjaxNetworkController

A SQL injection vulnerability has been identified in Advantech WebAccess/VPN versions prior to 1.1.5. The issue resides in the AjaxNetworkController.ajaxAction() method, where an authenticated low-privileged observer user can inject SQL through datatable search parameters. This injection could lead to unauthorized disclosure of database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could result in unauthorized data access, data modification, or in some cases, executing administrative operations on the database.

Remediation

Users are advised to upgrade to Advantech WebAccess/VPN version 1.1.5.