VulnerabilityModified

CVE-2014-0763

An attacker using SQL injection may use arguments to construct queries without proper sanitization.

HIGH 7.5EPSS 19.2%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 19.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. This may allow unexpected SQL action and access to records in the table of the software database or execution of arbitrary code.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 19.24% probability · 97th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: advantech/advantech webaccess
Source: ics-cert@hq.dhs.gov

References

http://webaccess.advantech.com/
http://www.securityfocus.com/bid/66740
https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03
http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03US Government Resource
http://www.securityfocus.com/bid/66740

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.