PT-2017-17718 · Websitebaker · Websitebaker

Marek Alaksa · Published 2017-04-03 · Updated 2020-07-07 · CVE-2017-7410

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebsiteBaker versions 2.10.0 and earlier

Description The issue concerns SQL injection vulnerabilities in certain PHP files. These vulnerabilities allow remote attackers to execute arbitrary SQL commands via the username and display name parameters.

Recommendations For versions 2.10.0 and earlier, update to a version later than 2.10.0 to resolve the issue. As a temporary workaround, consider restricting access to the account/signup.php and account/signup2.php files until a patch is available. Avoid using the username and display name parameters in the affected files until the issue is resolved.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-7410

Affected Products

Websitebaker

References · 6

• http://project.websitebaker.org/issues/39 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7410 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7410 · Vendor Advisory
• http://securitytracker.com/id/1038173 · Note
• http://forum.websitebaker.org/index.php/topic%2C30187.0.html · Note
• http://securityfocus.com/bid/97495 · Note