Advantech iView SQL Injection and Remote Code Execution Vulnerability

A vulnerability in Advantech iView prior to version 5.7.05 build 7057 allows authenticated attackers with user-level privileges to exploit SQL injection and execute remote code. The issue arises in the NetworkServlet.getNextTrapPage() function, where certain parameters are inadequately sanitized. This exploitation could lead to the execution of code under the 'nt authority\local service' account.

Impact

Exploitation of this vulnerability could result in unauthorized SQL injection, remote code execution, and potential disruption of services.

Remediation

Users are advised to update to Advantech iView version 5.7.05 build 7057.