Vulnerability · Published Feb 15, 2024 · Assigned by twcert

CVE-2024-1523EC-WEB FS-EZViewer(Web) - SQL Injection

High 8.8

In plain English

A high-severity SQL injection in FS-EZViewer(Web) from EC-WEB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.8%top 43.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

EC-WEB FS-EZViewer(Web)'s query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even leverage the dbo privilege in the database for privilege escalation, elevating their privileges to administrator.

Affected products (as reported)

Vendor	Product	Versions
EC-WEB	FS-EZViewer(Web)	– through 10.5.x.x

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.twcert.org.tw/tw/cp-132-7672-7eeac-1.html third-party-advisory