PT-2019-7909 · Ambit Technologies Pvt. · Itech B2B Script+11

Publicado 2019-05-09 · Atualizado 2019-05-10 · CVE-2017-12757

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ambit Technologies Pvt. Ltd products, including: iTech B2B Script version 4.42i Tech Business Networking Script version 8.26i Tech Caregiver Script version 2.71i Tech Classifieds Script version 7.41i Tech Dating Script version 3.40i Tech Freelancer Script version 5.27i Tech Image Sharing Script version 4.13i Tech Job Script version 9.27i Tech Movie Script version 7.51i Tech Multi Vendor Script version 6.63i Tech Social Networking Script version 3.08i Tech Travel Script version 9.49

Description The issue affects certain Ambit Technologies Pvt. Ltd products and is related to SQL Injection, allowing for remote code execution.

Recommendations For each of the affected products, update to a version that includes a fix for the SQL Injection issue. As a temporary workaround, consider restricting access to sensitive database operations until a patch is available. Avoid using user-input data directly in SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-12757

Produtos afetados

Tech Business Networking Script

Tech Caregiver Script

Tech Classifieds Script

Tech Dating Script

Tech Freelancer Script

Tech Image Sharing Script

Tech Job Script

Tech Movie Script

Tech Multi Vendor Script

Tech Social Networking Script

Tech Travel Script

Itech B2B Script

Referências · 5

• 🔥 https://exploit-db.com/exploits/42507 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-12757 · Nota de Segurança
• http://ambit.com · Nota
• https://osv.dev/vulnerability/CVE-2017-12757 · Aviso do Fabricante
• http://itech.com · Nota