PT-2017-14964 · Trape · Trape

Published 2017-12-16 · Updated 2018-01-04 · CVE-2017-17713

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trape versions prior to 2017-11-05

Description The issue allows for SQL injection through various parameters and HTTP headers, including the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, and several /register parameters such as country, countryCode, cpu, isp, lat, lon, org, query, region, regionName, timezone, vId, and zip, as well as the /tping id parameter.

Recommendations For Trape versions prior to 2017-11-05, consider restricting access to the vulnerable API endpoints, such as /nr and /register, and avoid using the specified parameters, including red, vId, User-Agent, country, countryCode, cpu, isp, lat, lon, org, query, region, regionName, timezone, zip, and id, until a fix is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-17713

Affected Products

Trape

References · 7

• 🔥 https://youtube.com/watch?v=efmvL235S-8 · Exploit
• 🔥 https://youtube.com/watch?v=RWw1UTeZee8 · Exploit
• 🔥 https://seekurity.com/blog/general/cve-2017-17713-and-cve-2017-17714-multiple-sql-injections-and-xss-vulnerabilities-found-in-the-hackers-tracking-tool-trape-boxug · Exploit
• 🔥 https://youtube.com/watch?v=Txp6IwR24jY · Exploit
• https://github.com/boxug/trape/commit/628149159ba25adbfc29a3ae1d4b10c7eb936dd3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-17713 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17713 · Vendor Advisory