CVE-2020-14497
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-contr
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a Advantech iView
Version range not reported
References 25
us-cert.cisa.gov
zerodayinitiative.com
- advisories/ZDI-20-847
- advisories/ZDI-20-827
- advisories/ZDI-20-868
- advisories/ZDI-20-852
- advisories/ZDI-20-862
- advisories/ZDI-20-860
- advisories/ZDI-20-846
- advisories/ZDI-20-844
- advisories/ZDI-20-845
- advisories/ZDI-20-855
- advisories/ZDI-20-857
- advisories/ZDI-20-854
- advisories/ZDI-20-864
- advisories/ZDI-20-849
- advisories/ZDI-20-832
- advisories/ZDI-20-835
- advisories/ZDI-20-848
- advisories/ZDI-20-838
- advisories/ZDI-20-850
- advisories/ZDI-20-856
- advisories/ZDI-20-866
- advisories/ZDI-20-842
- advisories/ZDI-20-837
- advisories/ZDI-20-865