PT-2017-14933 · Unknown · Car Rental Script

Ihsan Sencan · Published 2017-12-13 · Updated 2017-12-29 · CVE-2017-17637

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Car Rental Script version 2.0.4

Description The issue is related to SQL Injection, which occurs via the val parameter in the countrycode1.php file.

Recommendations For Car Rental Script version 2.0.4, avoid using the val parameter in the countrycode1.php file until the issue is resolved. Consider temporarily restricting access to the countrycode1.php file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-17637

Affected Products

Car Rental Script

References · 4

• 🔥 https://packetstormsecurity.com/files/145349/Car-Rental-Script-2.0.4-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/43308 · Exploit
• https://osv.dev/vulnerability/CVE-2017-17637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17637 · Security Note