{"uuid": "a230fab9-519c-4f0c-ad14-617f52f1f072", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0763", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"rgod \", \"juan vazquez \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a SQL injection vulnerability found in Advantech WebAccess 7.1. The\\n          vulnerability exists in the DBVisitor.dll component, and can be abused through malicious\\n          requests to the ChartThemeConfig web service. This module can be used to extract the site\\n          and project usernames and hashes.\", \"disclosure_date\": \"2014-04-08\", \"fullname\": \"auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli\", \"is_install_path\": true, \"mod_time\": \"2026-04-15 11:57:01 +0000\", \"name\": \"Advantech WebAccess DBVisitor.dll ChartThemeConfig SQL Injection\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/scada/advantech_webaccess_dbvisitor_sqli\", \"references\": [\"CVE-2014-0763\", \"ZDI-14-077\", \"OSVDB-105572\", \"BID-66740\", \"URL-https://ics-cert.us-cert.gov/advisories/ICSA-14-079-03\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:55.278218Z"}