PT-2017-14892

CVE-2017-17597

Published

2017-12-13

Updated

2017-12-22

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nearbuy Clone Script version 3.2

Description The issue is related to SQL Injection, which occurs via the category list.php search parameter. This allows for potential exploitation.

Recommendations For Nearbuy Clone Script version 3.2, update the script to properly sanitize and validate user input for the search parameter in category list.php to prevent SQL Injection attacks. As a temporary workaround, consider restricting access to the category list.php page until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Ihsan Sencan

Ihsansencan

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers