Unscored severity · published Apr 12, 2014
CVE-2014-0763
An attacker using SQL injection may use arguments to construct queries without proper sanitization
–
CVSS
15.9%
EPSS
No
On KEV
Description
An attacker using SQL injection may use arguments to construct queries
without proper sanitization. The DBVisitor.dll is exposed through SOAP
interfaces, and the exposed functions are vulnerable to SOAP injection.
This may allow unexpected SQL action and access to records in the table
of the software database or execution of arbitrary code.
Exploitation
Is it being used?
Exploit prediction (EPSS)15.9% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Advantech Webaccess · Advantech
through 7.1; 5.0; 6.0; 7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0763
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0763
webaccess.advantech.com
http://webaccess.advantech.com/
www.securityfocus.com
http://www.securityfocus.com/bid/66740
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
US Government Resource
http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03
More from Advantech Webaccess
–
CVE-2014-0992
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the password parameter
–
CVE-2014-0991
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname parameter
–
CVE-2014-0990
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName parameter
–
CVE-2014-0989
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter
–
CVE-2014-0988
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter