CVE-2022-3323

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-332307.8Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host CVE-2022-332317.8Memory corruption due to double free in core while initializing the encryption key.CVE-2022-332327.8Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory.CVE-2022-332337.8Memory corruption due to configuration weakness in modem wile sending command to write protected files.CVE-2022-332349.8Memory corruption in video due to configuration weakness. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consum CVE-2022-332357.5Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes. in Snapdragon Auto, Snapdrag CVE-2022-332367.5Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes. in Snapdragon Compute, Snapdragon Connect CVE-2022-332377.5Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold. in Snapdragon Auto, Snapdragon Compute, Snapdragon Co CVE-2022-332387.5Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames. in Snapdragon Auto, Snapdragon Co CVE-2022-332397.5Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snapdragon Auto, Snapdrag CVE-2022-33247.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.CVE-2022-332407.8Memory corruption in Audio due to incorrect type cast during audio use-cases.