Advantech WebAccess upAdminPg Information Disclosure Vulnerability

2016-07-18T00:00:00
ID ZDI-16-429
Type zdi
Reporter Zhou Yu
Modified 2016-11-09T00:00:00

Description

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess. Authentication is required to exploit this vulnerability.

The specific flaw exists within upAdminPg.asp. One project administrator can view other project administrators' passwords along with the system administrator's password. An attacker can leverage this vulnerability to escalate privileges within the system.