PT-2017-14906
CVE-2017-17610
·
تاريخ النشر
2017-12-13
·
تاريخ التحديث
2017-12-26
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
E-commerce MLM Software version 1.0
Description
The issue concerns SQL Injection, which can be exploited through specific parameters in several PHP files. The vulnerable parameters are
pid in 'service detail.php', eventid in 'event detail.php', and newid in 'news detail.php'.Recommendations
For E-commerce MLM Software version 1.0, consider restricting access to the
service detail.php, event detail.php, and news detail.php files until a patch is available. As a temporary workaround, avoid using the pid, eventid, and newid parameters in their respective API endpoints until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾