PT-2022-7996 · Logostore · Logostore

Kaan Kamis · Published 2022-07-14 · Updated 2022-07-21 · CVE-2017-20129

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions LogoStore (affected versions not specified)

Description A critical issue has been identified, allowing for SQL injection through the manipulation of the query argument in the /LogoStore/search.php file. This can be achieved by providing a specific input, such as ' UNION ALL SELECT CONCAT(CONCAT('qqkkq','VnPVWVaYxljWqGpLLbEIyPIHBjjjjASQTnaqfKaV'),'qvvpq'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- oCrh&search=. The attack can be launched remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-20129

Affected Products

Logostore

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-20129 · Security Note
• https://t.me/cvenotify/33040 · Telegram Post
• https://vuldb.com/?id.96540 · Note
• https://t.me/cibsecurity/46221 · Telegram Post