CVE-2017-5154
CRITICALAdvantech WebAccess 8.1 Post Authentication Credential Collector
Title source: metasploitExploitation Summary
EIP tracks 1 public exploit for CVE-2017-5154.
PoCs published by h00die, sinn3r, including Metasploit module auxiliary/gather/advantech_webaccess_creds.
AI-analyzed exploit summary This Metasploit module exploits an information disclosure vulnerability in Advantech WebAccess 8.1 to collect credentials post-authentication. It logs in, enumerates users, and retrieves their passwords via unauthenticated access to administrative pages.
Description
An issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an attacker must supply malformed input to the WebAccess software. Successful attack could result in administrative access to the application and its data files.
Exploits (1)
This Metasploit module exploits an information disclosure vulnerability in Advantech WebAccess 8.1 to collect credentials post-authentication. It logs in, enumerates users, and retrieves their passwords via unauthenticated access to administrative pages.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H