PT-2017-14315 · Project · Iproject Management System

Ihsan Sencan · Published 2017-10-29 · Updated 2017-11-17 · CVE-2017-15961

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iProject Management System version 1.0

Description The issue allows SQL Injection via the ID parameter to "index.php".

Recommendations For iProject Management System version 1.0, avoid using the ID parameter in the "index.php" endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-15961

Affected Products

Iproject Management System

References · 4

• 🔥 https://exploit-db.com/exploits/43098 · Exploit
• https://osv.dev/vulnerability/CVE-2017-15961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15961 · Security Note
• https://packetstormsecurity.com/files/144432/iProject-Management-System-1.0-SQL-Injection.html · Note