Sign-up

ID

VAR-201202-0342


CVE

CVE-2012-1234


TITLE

Advantech/BroadWin WebAccess SQL Injection Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2012-9018 // CNNVD: CNNVD-201202-421

DESCRIPTION

SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234. BroadWin SCADA WebAccess is a web browser-based HMI and SCADA software for industrial control systems and automation

Trust: 2.61

sources: NVD: CVE-2012-1234 // JVNDB: JVNDB-2012-001563 // CNVD: CNVD-2012-9018 // IVD: 7d787100-463f-11e9-b84d-000c29342cb1 // IVD: 1a20d46e-2354-11e6-abef-000c29c66e3d // VULHUB: VHN-54515

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.0

sources: IVD: 7d787100-463f-11e9-b84d-000c29342cb1 // IVD: 1a20d46e-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-9018

AFFECTED PRODUCTS

vendor:advantechmodel:webaccessscope:eqversion:5.0

Trust: 1.6

vendor:advantechmodel:webaccessscope:lteversion:6.0

Trust: 1.0

vendor:broadwinmodel:webaccessscope:eqversion:7.0

Trust: 0.8

vendor:advantechmodel:webaccessscope:eqversion:7.0

Trust: 0.8

vendor:webaccessmodel:advantech/broadwinscope:eqversion:7.0

Trust: 0.6

vendor:advantechmodel:webaccessscope:eqversion:6.0

Trust: 0.6

vendor:advantech webaccessmodel: - scope:eqversion:5.0

Trust: 0.4

vendor:advantech webaccessmodel: - scope:eqversion:*

Trust: 0.4

sources: IVD: 7d787100-463f-11e9-b84d-000c29342cb1 // IVD: 1a20d46e-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-9018 // JVNDB: JVNDB-2012-001563 // CNNVD: CNNVD-201202-421 // NVD: CVE-2012-1234

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-1234
value: MEDIUM

Trust: 1.0

NVD: CVE-2012-1234
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2012-9018
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201202-421
value: MEDIUM

Trust: 0.6

IVD: 7d787100-463f-11e9-b84d-000c29342cb1
value: MEDIUM

Trust: 0.2

IVD: 1a20d46e-2354-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

VULHUB: VHN-54515
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2012-1234
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2012-9018
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:M/AU:N/C:C/I:P/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: PARTIAL
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 9.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 7d787100-463f-11e9-b84d-000c29342cb1
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:M/AU:N/C:C/I:P/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: PARTIAL
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 9.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 1a20d46e-2354-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:M/AU:N/C:C/I:P/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: PARTIAL
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 9.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-54515
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 7d787100-463f-11e9-b84d-000c29342cb1 // IVD: 1a20d46e-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-9018 // VULHUB: VHN-54515 // JVNDB: JVNDB-2012-001563 // CNNVD: CNNVD-201202-421 // NVD: CVE-2012-1234

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.9

sources: VULHUB: VHN-54515 // JVNDB: JVNDB-2012-001563 // NVD: CVE-2012-1234

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201202-421

TYPE

SQL injection

Trust: 1.0

sources: IVD: 7d787100-463f-11e9-b84d-000c29342cb1 // IVD: 1a20d46e-2354-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201202-421

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-001563

PATCH
title:WebAccessurl:http://www.advantech.co.jp/products/Webaccess-HMI-SCADA-Software/sub_GF-1M94V.aspx
Trust: 0.8
title:WebAccessurl:http://www.broadwin.com/features.htm
Trust: 0.8
title:Offices Distributorsurl:http://www.broadwin.com/Offices.htm
Trust: 0.8
title:パートナー情報url:http://www.advantech.co.jp/support-AJP/distributors.asp
Trust: 0.8
title:Top Pageurl:http://www.advantech.co.jp/
Trust: 0.8
title:Advantech/BroadWin WebAccess SQL Injection Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/34073
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2012-9018 // 
            
            
            
            JVNDB: JVNDB-2012-001563

EXTERNAL IDS
db:NVDid:CVE-2012-1234
Trust: 3.5
db:ICS CERTid:ICSA-12-047-01
Trust: 1.7
db:CNNVDid:CNNVD-201202-421
Trust: 1.1
db:CNVDid:CNVD-2012-9018
Trust: 1.0
db:ICS CERTid:ICSA-12-047-01A
Trust: 0.8
db:JVNDBid:JVNDB-2012-001563
Trust: 0.8
db:IVDid:7D787100-463F-11E9-B84D-000C29342CB1
Trust: 0.2
db:IVDid:1A20D46E-2354-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:VULHUBid:VHN-54515
Trust: 0.1
sources:
            
            
            IVD: 7d787100-463f-11e9-b84d-000c29342cb1 // 
            
            
            
            IVD: 1a20d46e-2354-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2012-9018 // 
            
            
            
            VULHUB: VHN-54515 // 
            
            
            
            JVNDB: JVNDB-2012-001563 // 
            
            
            
            CNNVD: CNNVD-201202-421 // 
            
            
            
            NVD: CVE-2012-1234

REFERENCES
url:http://www.us-cert.gov/control_systems/pdf/icsa-12-047-01.pdf
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1234
Trust: 0.8
url:http://www.us-cert.gov/control_systems/pdf/icsa-12-047-01a.pdf
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1234
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/search-results?query=cve-2012-1234
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2012-9018 // 
            
            
            
            VULHUB: VHN-54515 // 
            
            
            
            JVNDB: JVNDB-2012-001563 // 
            
            
            
            CNNVD: CNNVD-201202-421 // 
            
            
            
            NVD: CVE-2012-1234

SOURCES
db:IVDid:7d787100-463f-11e9-b84d-000c29342cb1
db:IVDid:1a20d46e-2354-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2012-9018
db:VULHUBid:VHN-54515
db:JVNDBid:JVNDB-2012-001563
db:CNNVDid:CNNVD-201202-421
db:NVDid:CVE-2012-1234

LAST UPDATE DATE
2024-08-14T13:36:42.651000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2012-9018date:2012-02-22T00:00:00
db:VULHUBid:VHN-54515date:2012-02-23T00:00:00
db:JVNDBid:JVNDB-2012-001563date:2012-02-23T00:00:00
db:CNNVDid:CNNVD-201202-421date:2012-02-22T00:00:00
db:NVDid:CVE-2012-1234date:2012-02-23T05:00:00

SOURCES RELEASE DATE
db:IVDid:7d787100-463f-11e9-b84d-000c29342cb1date:2012-02-22T00:00:00
db:IVDid:1a20d46e-2354-11e6-abef-000c29c66e3ddate:2012-02-22T00:00:00
db:CNVDid:CNVD-2012-9018date:2012-02-22T00:00:00
db:VULHUBid:VHN-54515date:2012-02-21T00:00:00
db:JVNDBid:JVNDB-2012-001563date:2012-02-23T00:00:00
db:CNNVDid:CNNVD-201202-421date:2012-02-22T00:00:00
db:NVDid:CVE-2012-1234date:2012-02-21T13:31:57.297