PT-2017-14875

CVE-2017-17580

Publicado

2017-12-13

Atualizado

2020-09-29

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FS Linkedin Clone version 1.0

Description The issue concerns SQL Injection, which can be exploited via specific parameters in certain PHP files. The vulnerable parameters include grid in "group.php", fid in "profile.php", and id in "company details.php".

Recommendations For FS Linkedin Clone version 1.0, consider restricting access to the vulnerable parameters grid, fid, and id in the respective PHP files until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Ihsan Sencan

Ihsansencan

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Identificadores relacionados