PT-2017-16346

Name of the Vulnerable Software and Affected Versions Advantech WebAccess version 8.1 Description An issue was discovered that allows a malicious user to bypass authentication and access pages unrestricted by accessing a specific uniform resource locator URL on the web server. Recommendations For...

CVE-2017-5154: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an attacker must supply malformed input to the WebAccess software. Successful attack could result in administrative access to the application and its data files...

CVE-2017-5152: Improper Authentication

An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator URL on the web server, a malicious user is able to access pages unrestricted AUTHENTICATION BYPASS...

Advantech WebAccess 'updateTemplate.aspx' SQL Injection and Authentication Bypass Vulnerabilities

Advantech WebAccess is prone to an SQL injection SQLi vulnerability and an authentication-bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Advantech WebAccess Authentication Bypass

Binary data scadaadvantechwebaccesscve-2017-5152.nbin...

Advantech WebAccess SQLi

Binary data scadaadvantechwebaccesscve-2017-5154.nbin...

Advantech WebAccess Login

This module will attempt to authenticate to Advantech WebAccess. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/advantechwebaccess' require...

Advantech WebAccess updateTemplate.aspx SQL Injection (CVE-2017-5154)

An SQL injection vulnerability has been reported in Advantech WebAccess. The vulnerability is due to insufficient validation of the template parameter in HTTP request sent to the updateTemplate.aspx. A remote attacker could exploit this vulnerability by sending a HTTP request with a malicious SQL...

Advantech WebAccess 8.1 Post Authentication Credential Collector

This module allows you to log into Advantech WebAccess 8.1, and collect all of the credentials. Although authentication is required, any level of user permission can exploit this vulnerability. Note that 8.2 is not suitable for this. Module Options msf use auxiliary/gather/advantech/webaccesscred...

Advantech WebAccess 'updateTemplate.aspx' SQL Injection Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A SQL injection vulnerability exists in Advantech WebAcces...

Advantech WebAccess Security Bypass Vulnerability

Advantech WebAccess formerly known as BroadWinWebAccess is a set of HMI/SCADA software based on browser architecture from Advantech. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A securit...

Advantech WebAccess Multiple Vulnerabilities

Advantech WebAccess is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2017-16348

Name of the Vulnerable Software and Affected Versions Advantech WebAccess version 8.1 Description An issue in Advantech WebAccess allows for SQL injection, which can be exploited by supplying malformed input to the software. A successful attack could result in administrative access to the...

Advantech WebAccess

CVSS V3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Advantech Equipment: WebAccess Vulnerabilities: Authentication Bypass, SQL Injection AFFECTED PRODUCTS The following WebAccess version is affected: WebAccess Version 8.1 IMPACT Successful exploitation of this...

Advantech WebAccess updateTemplate SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess. Authentication is required to exploit this vulnerability, but can be easily bypassed. The specific flaw exists within updateTemplate.aspx. The vulnerability is caused b...

Advantech WebAccess 8.x < 8.1 Multiple Vulnerabilities

Binary data 9862.prm...

Advantech WebAccess 8.x < 8.0-2015.08.16 RCE

Binary data 9861.prm...

Advantech WebAccess Version Detection (SCADA)

Binary data 9860.prm...

Advantech WebAccess Detection (SCADA)

Binary data 9859.prm...

Vulnerability in Advantech WebAccess ActiveX

Advantech WebAccess formerly known as BroadWin WebAccess is a set of HMI/SCADA software based on browser architecture from Advantech, China. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation devices.ActiveX is one of...