PT-2017-14934 · Unknown · Groupon Clone Script

Ihsan Sencan · Published 2017-12-13 · Updated 2017-12-26 · CVE-2017-17638

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Groupon Clone Script version 3.01

Description The issue is related to SQL Injection, which can be exploited via the state id parameter in the "city ajax.php" endpoint.

Recommendations For Groupon Clone Script version 3.01, update the script to properly sanitize and validate the state id parameter in the "city ajax.php" file to prevent SQL Injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-17638

Affected Products

Groupon Clone Script

References · 4

• 🔥 https://packetstormsecurity.com/files/145350/Groupon-Clone-Script-3.01-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/43309 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17638 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17638 · Vendor Advisory