Advantech iView SQL Injection and Remote Code Execution Vulnerability

A vulnerability in Advantech iView allows authenticated attackers with user-level privileges to perform SQL injection and execute remote code via the NetworkServlet.archiveTrap() function. The exploitation takes advantage of unsanitized input parameters, potentially leading to code execution in the context of the 'nt authority\local service' account.

Impact

Exploitation of this vulnerability could result in unauthorized SQL command execution, allowing attackers to manipulate databases or extract sensitive information. Additionally, it could lead to remote code execution on the affected system, with the executed code running under the 'nt authority\local service' account.

Remediation

Users are advised to update to Advantech iView version 5.7.05 build 7057.