SQL Injection vulnerability on SCAN_VISIO eDocument Suite Web Viewer from Abast

The SQL Injection vulnerability in SCAN_VISIO eDocument Suite Web Viewer poses a severe risk. An attacker can exploit this flaw to bypass authentication and directly interact with the database. This allows them to read sensitive data like user credentials, financial records, and proprietary documents. Furthermore, the attacker can modify or delete data, disrupting operations and potentially causing irreversible damage. The ability to update and delete data grants the attacker near-complete control over the affected system, making it a high-impact vulnerability. Successful exploitation could lead to a complete data breach and significant reputational damage for organizations using the software.

Organizations utilizing SCAN_VISIO eDocument Suite Web Viewer, particularly those with sensitive data stored in the database, are at significant risk. Environments with weak input validation or inadequate security controls are especially vulnerable. Shared hosting environments where multiple users share the same database instance are also at increased risk.

• other / web: Use a web proxy or browser extension to intercept and inspect HTTP requests to the login page. Look for unusual characters or SQL keywords in the 'user' parameter.

curl -v 'http://<target>/login?user=';

• generic web: Examine access and error logs for SQL errors or unusual database activity related to the login page. Search for patterns indicative of SQL Injection attempts.

grep -i 'SQL error' /var/log/apache2/error.log

• generic web: Check response headers for any unusual content or error messages that might indicate a vulnerability.

curl -I 'http://<target>/login?user=';

1. 2024-03-21Disclosure

   disclosure

1. आरक्षित2024-03-19
2. प्रकाशित2024-03-21
3. संशोधित2024-08-06
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-29732 is to immediately upgrade to version 3.28.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Input validation on the 'user' parameter in the login page is crucial; implement strict whitelisting and sanitization to prevent malicious SQL code from being injected. Web Application Firewalls (WAFs) configured to detect and block SQL Injection attempts can provide an additional layer of defense. Monitor application logs for suspicious SQL queries and unusual database activity. After upgrading, confirm the vulnerability is resolved by attempting a SQL Injection attack on the login page and verifying that the input is properly sanitized and does not result in database errors.