CVE-2018-5443

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/SCADA versions prior to V8.2 20170817

Description A SQL Injection issue was discovered in the software. It does not properly sanitize its inputs for SQL commands, which can lead to information disclosure. The issue is related to the uMailLogin and chkLogin2 functions, where the user variable is vulnerable to SQL injection.

Recommendations For versions prior to V8.2 20170817, update to version V8.2 20170817 or later to resolve the issue. As a temporary workaround, consider restricting access to the uMailLogin and chkLogin2 functions to minimize the risk of exploitation. Avoid using the user variable in affected API endpoints until the issue is resolved.