CVE-2024-1523: E-web Fs-ezviewer SQLi Vulnerability

CVE-2024-1523 Overview

CVE-2024-1523 is a SQL injection vulnerability in the EC-WEB FS-EZViewer(Web) query functionality. The application fails to properly restrict user input, allowing authenticated remote attackers with regular user privileges to inject arbitrary SQL commands. Successful exploitation permits reading, modifying, and deleting database records. Attackers can also execute system commands through the database interface. The vulnerability maps to CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Attackers holding dbo privileges in the backing database can escalate their access to administrator on the application.

Critical Impact
Authenticated attackers can achieve full database compromise, execute system commands, and escalate privileges to administrator through SQL injection in query functionality.

Affected Products

EC-WEB FS-EZViewer(Web)
e-web fs-ezviewer (all versions per NVD CPE data)
Deployments backed by databases where the application user holds dbo privileges

Discovery Timeline

2024-02-15 - CVE-2024-1523 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1523

Vulnerability Analysis

The vulnerability resides in the query functionality of FS-EZViewer(Web). User-supplied parameters flow into SQL statements without proper sanitization or parameterization. An authenticated regular user can craft input that alters the intended SQL query logic. This grants full read, write, and delete access to the underlying database.

The impact extends beyond data manipulation. When the application connects to the database with dbo (database owner) privileges, attackers can invoke database-level functionality to execute operating system commands. On Microsoft SQL Server backends, this typically means abusing xp_cmdshell or similar extended procedures. The dbo role also allows privilege escalation within the application by directly modifying administrator records or role assignments.

Root Cause

The root cause is missing input validation and lack of parameterized queries in the query endpoint. User input is concatenated directly into SQL statements. The application also runs with excessive database privileges, violating the principle of least privilege and amplifying exploitation impact.

Attack Vector

Exploitation requires network access to the web interface and valid credentials for a regular user account. The attacker submits crafted input through the query functionality. Because no verified public proof-of-concept is available, refer to the Taiwan CERT Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-1523

Indicators of Compromise

Web server access logs containing SQL metacharacters such as single quotes, UNION SELECT, --, or ; in query parameters submitted to FS-EZViewer(Web) endpoints
Database logs showing execution of xp_cmdshell, sp_OACreate, or other command-execution procedures from the application service account
Unexpected creation, modification, or deletion of administrator accounts in the FS-EZViewer application database
Outbound network connections from the database host to attacker-controlled infrastructure

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting FS-EZViewer query parameters
Enable SQL Server audit logging for extended stored procedures and privileged operations executed by the application service account
Correlate authenticated user sessions with anomalous query volume or error-based SQL responses

Monitoring Recommendations

Monitor database process trees for child processes such as cmd.exe or powershell.exe spawned from sqlservr.exe
Alert on privilege changes within the FS-EZViewer user tables
Track failed and successful authentication events tied to unusual query behavior from regular user accounts

How to Mitigate CVE-2024-1523

Immediate Actions Required

Contact the vendor through the Taiwan CERT Security Advisory to obtain the current patched release of FS-EZViewer(Web)
Restrict network access to the FS-EZViewer(Web) interface to trusted internal networks and VPN users
Rotate credentials for all FS-EZViewer application accounts and audit for unauthorized administrator accounts
Remove dbo privileges from the application's database service account and grant only the minimum permissions required

Patch Information

Refer to the Taiwan CERT Security Advisory for vendor-supplied patch information. No public vendor advisory URL is listed in NVD beyond the Taiwan CERT reference.

Workarounds

Disable or restrict access to the affected query functionality until the patch is applied
Deploy WAF rules that block SQL injection payloads targeting FS-EZViewer query parameters
Disable xp_cmdshell and other command-execution extended stored procedures on the SQL Server backend
Apply the principle of least privilege by removing dbo and sysadmin roles from the application database account

bash

# Disable xp_cmdshell on Microsoft SQL Server to limit command execution impact
sqlcmd -S <server> -Q "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;"

# Revoke dbo membership from the application service account
sqlcmd -S <server> -Q "ALTER ROLE db_owner DROP MEMBER [fs_ezviewer_app];"