CVE-2023-3983
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection.
Risk Assessment
This vulnerability may lead to unauthorized access to the database, posing a serious threat to the integrity and confidentiality of data within the organization.
Recommendation
It is recommended to update Advantech iView to version v5.7.4 build 6752 or later to mitigate this vulnerability.
Original NVD description (English source)
An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection.