Advantech iView SQL Injection and Remote Code Execution Vulnerability

A vulnerability in Advantech iView prior to version 5.7.05 build 7057 allows authenticated attackers with user-level privileges to exploit SQL injection and execute remote code. The issue arises in the NetworkServlet.archiveTrapRange() function, where certain input parameters are not properly sanitized. This exploitation could lead to executing code in the context of the 'nt authority\local service' account.

Impact

Exploitation of this vulnerability could result in unauthorized SQL command execution, allowing attackers to manipulate the database or extract sensitive information. Additionally, it could lead to remote code execution, with the executed code running under the 'nt authority\local service' account.

Remediation

Users are advised to update to Advantech iView version 5.7.05 build 7057.