PT-2017-14340 · Unknown · Basic B2B Script

Ihsan Sencan + 1 · Publicado 2017-10-31 · Atualizado 2017-11-18 · CVE-2017-15985

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Basic B2B Script (affected versions not specified)

Description The issue allows SQL Injection via the product view1.php page, specifically through the pid or id parameters.

Recommendations For all affected versions, avoid using the pid or id parameters in the product view1.php page until the issue is resolved. As a temporary workaround, consider restricting access to the product view1.php page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-15985

Produtos afetados

Basic B2B Script

Referências · 2

• 🔥 https://exploit-db.com/exploits/43074 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-15985 · Nota de Segurança