PT-2025-15689 · Unknown · Roommate-Bill-Tracking

Published 2025-04-09 · Updated 2025-04-09 · CVE-2017-20197

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: propanetank Roommate-Bill-Tracking versions up to 288437f658fc9ee7d4b92a9da12557024d8bc55c

Description: A critical issue has been found in the code of the /includes/login.php file. The manipulation of the Username argument leads to SQL injection. This issue can be exploited remotely.

Recommendations: For versions up to 288437f658fc9ee7d4b92a9da12557024d8bc55c, apply the patch b32bb1b940f82d38fb9310cd66ebe349e20a1d0a to fix this issue. As a temporary workaround, consider restricting access to the /includes/login.php file until the patch is applied. Avoid using the Username argument in the affected login functionality until the issue is resolved.

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2017-20197

Affected Products

Roommate-Bill-Tracking

References · 8

• https://osv.dev/vulnerability/CVE-2017-20197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-20197 · Security Note
• https://t.me/cvenotify/118414 · Telegram Post
• https://vuldb.com/?id.303640 · Note
• https://t.me/cvedetector/22557 · Telegram Post
• https://github.com/propanetank/Roommate-Bill-Tracking/commit/b32bb1b940f82d38fb9310cd66ebe349e20a1d0a · Note
• https://t.me/cvetracker/21211 · Telegram Post
• https://vuldb.com/?ctiid.303640 · Note