Advantech WebAccess/VPN SQL Injection Vulnerability in AjaxFwRulesController

A SQL injection vulnerability has been identified in Advantech WebAccess/VPN versions prior to 1.1.5. The issue resides in the AjaxFwRulesController.ajaxNetworkFwRulesAction() method, where an authenticated low-privileged observer user can inject SQL through datatable search parameters. This injection could lead to unauthorized disclosure of database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker could manipulate database queries to access, modify, or delete database information. In this specific case, the vulnerability could be exploited to disclose sensitive database information.

Remediation

Users are advised to upgrade to Advantech WebAccess/VPN version 1.1.5.