A vulnerability classified as critical has been found in Itech Classifieds Script 7.27. Affected is an unknown function of the file /subpage.php. The manipulation of the argument scat with the input =51' AND 4941=4941 AND 'hoCP'='hoCP leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://vuldb.com/?id.96282 | Third Party Advisory |
| https://www.exploit-db.com/exploits/41189/ | Third Party Advisory VDB Entry |
Configurations
History
19 Jul 2022, 10:30
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CPE | cpe:2.3:a:itechscripts:classifieds_script:7.27:*:*:*:*:*:*:* | |
| References | (MISC) https://www.exploit-db.com/exploits/41189/ - Third Party Advisory, VDB Entry | |
| References | (MISC) https://vuldb.com/?id.96282 - Third Party Advisory |
16 Jul 2022, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-07-16 07:15
Updated : 2024-02-04 22:51
NVD link : CVE-2017-20136
Mitre link : CVE-2017-20136
CVE.ORG link : CVE-2017-20136
JSON object : View
Products Affected
itechscripts
- classifieds_script
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')