PT-2017-18529 · Accellion · Accellion Fta

Published 2017-05-05 · Updated 2017-05-17 · CVE-2017-8789

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180

Description A SQL injection issue exists due to a report error.php API endpoint that is vulnerable to injection attacks. The year parameter is specifically mentioned as a vector for this injection. This could potentially allow an attacker to execute unauthorized SQL commands.

Recommendations For versions prior to FTA 9 12 180, update to FTA 9 12 180 or later to resolve the issue. As a temporary workaround, consider restricting access to the report error.php API endpoint to minimize the risk of exploitation. Avoid using the year parameter in the report error.php endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-8789

Affected Products

Accellion Fta

References · 3

• 🔥 https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8789 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8789 · Vendor Advisory