PT-2017-15145 · Biometric Shift · Biometric Shift Employee Management System

52Pojie · Published 2017-12-30 · Updated 2018-01-09 · CVE-2017-17989

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System (affected versions not specified)

Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to the lack of proper input validation in the holiday name parameter when performing an edit holiday action in the index.php file.

Recommendations As a temporary workaround, consider restricting access to the index.php file or the edit holiday action until a patch is available. Avoid using the holiday name parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-17989

Affected Products

Biometric Shift Employee Management System

References · 3

• 🔥 https://github.com/d4wner/Vulnerabilities-Report/blob/master/Biometric-Shift-Employee-Management-System.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17989 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17989 · Vendor Advisory