Advantech WebAccess upAdminPg Information Disclosure Vulnerability

ID ZDI-16-429
Type zdi
Reporter Zhou Yu
Modified 2016-06-22T00:00:00


This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess. Authentication is required to exploit this vulnerability. The specific flaw exists within upAdminPg.asp. One project administrator can view other project administrators' passwords along with the system administrator's password. An attacker can leverage this vulnerability to escalate privileges within the system.