PT-2017-14894 · Unknown · Advance Online Learning Management Script

Ihsan Sencan + 1 · Published 2017-12-13 · Updated 2017-12-22 · CVE-2017-17599

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advance Online Learning Management Script version 3.1

Description The issue is related to SQL Injection, which can be exploited via the courselist.php subcatid or popcourseid parameters.

Recommendations For Advance Online Learning Management Script version 3.1, consider restricting access to the courselist.php page or validating and sanitizing the subcatid and popcourseid parameters to prevent SQL Injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-17599

Affected Products

Advance Online Learning Management Script

References · 4

• 🔥 https://exploit-db.com/exploits/43264 · Exploit
• 🔥 https://packetstormsecurity.com/files/145300/Advance-Online-Learning-Management-Script-3.1-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17599 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17599 · Vendor Advisory