CVE-2024-1523: EC-WEB FS-EZViewer(Web) - SQL Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-15 · updated 2026-06-17
Weakness: CWE-89

Description

EC-WEB FS-EZViewer(Web)'s query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even leverage the dbo privilege in the database for privilege escalation, elevating their privileges to administrator.

Affected products

EC-WEB FS-EZViewer(Web): before 10.6.0.0 — fixed in 10.6.0.0

How to fix

Upgrade to a fixed version: EC-WEB FS-EZViewer(Web) 10.6.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1523 or the next vulnerability affects your stack