Advantech iView SQL Injection Vulnerability Allowing Information Disclosure or Denial-of-Service

A SQL injection vulnerability has been identified in Advantech iView, specifically in versions prior to 5.7.05 build 7057. This vulnerability arises from improper input validation in the CUtils.checkSQLInjection() function, allowing authenticated attackers with user-level privileges to manipulate SQL queries. Exploitation of this vulnerability could lead to unauthorized information disclosure or a denial-of-service condition.

Impact

Exploitation of this vulnerability could result in SQL injection, allowing attackers to interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or causing the application to become unresponsive.

Remediation

Users are advised to update to Advantech iView version 5.7.05 build 7057.