Description
An attacker using SQL injection may use arguments to construct queries
without proper sanitization. The DBVisitor.dll is exposed through SOAP
interfaces, and the exposed functions are vulnerable to SOAP injection.
This may allow unexpected SQL action and access to records in the table
of the software database or execution of arbitrary code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Advantech | WebAccess | ≤ 7.1 | 7.2 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Advantech WebAccess DBVisitor.dll ChartThemeConfig SQL Injection
auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- ICSA-14-079-03 Advantech WebAccess Vulnerabilities CISA ICS & IT advisories · Jun 9, 2025