Advantech WebAccess/VPN SQL Injection Vulnerability in NetworksController

A SQL injection vulnerability has been identified in Advantech WebAccess/VPN versions prior to 1.1.5. The issue resides in the NetworksController.addNetworkAction() method, where an authenticated low-privileged observer user can inject SQL through datatable search parameters. This injection could lead to unauthorized disclosure of database information.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker could manipulate database queries. This could result in unauthorized data access or modification.

Remediation

Users are advised to upgrade to Advantech WebAccess/VPN version 1.1.5.