CVE-2017-20246

Name of the Vulnerable Software and Affected Versions KittyCatfish version 2.2

Description An SQL injection allows unauthenticated attackers to read database contents by exploiting an unescaped GET parameter. Attackers can inject SQL code through the kc ad parameter in the 'base.css.php' or 'kittycatfish.php' endpoints to extract sensitive information using boolean-based blind or time-based blind techniques. Boolean-based blind SQL injection is a method where the attacker asks the database true or false questions and determines the answer based on whether the page loads normally or returns an error. Time-based blind SQL injection relies on the database pausing its execution for a specified duration before responding if a condition is true.

Recommendations For version 2.2, avoid using the kc ad parameter in the 'base.css.php' and 'kittycatfish.php' endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.