Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

AUO SunVeillance Monitoring System may expose data through web form

CVE-2019-12720 · published 6 years ago
Summary

The SunVeillance Monitoring System web interface lets an attacker insert malicious commands into several pages, such as the email‑sending page and some picture and account pages. This can let the attacker read information that should be private. Apply the vendor’s update to version 1.1.9e or later, or patch the affected pages to block such input.

What to do
  • Update auo sunveillance_monitoring_system_\&_data_recorder to version 1.1.9e or later.
Affected software
VendorProductAffected versions
auo sunveillance_monitoring_system_\&_data_recorder < 1.1.9e
cpe:2.3:a:auo:sunveillance_monitoring_system_\&_data_recorder:*:*:*:*:*:*:*:*
Original advisory text
AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvc_send_mail.aspx (MailAdd parameter) SQL Injection. An Attacker can carry a SQL Injection payload to the server, allowing the at...
AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvc_send_mail.aspx (MailAdd parameter) SQL Injection. An Attacker can carry a SQL Injection payload to the server, allowing the attacker to read privileged data. This also affects the picture_manage_mvc.aspx plant_no parameter, the swapdl_mvc.aspx plant_no parameter, and the account_management.aspx Text_Postal_Code and Text_Dis_Code parameters.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published12 Nov 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-12720 · NVD
Track software like this
Free during beta