KB Messages PHP Script 1.0 username/password sql injection

W KB Messages PHP Script 1.0 została stwierdzona podatność. Podatnością dotknięta jest nieznana funkcja. Poprzez manipulowanie argumentem username/password wartością wejściową 'or''=' przy użyciu nieznanych danych wejściowych można doprowadzić do wystąpienia podatności sql injection. Raport na temat podatności został udostępniony pod adresem exploit-db.com. Identyfikatorem tej podatności jest CVE-2017-20128. Atak może zostać zainicjowany zdalnie. Techniczne szczegóły są znane. Uważa się go za proof-of-concept. Exploit można ściągnąć pod adresem exploit-db.com. Potencjalne zabezpieczenie zostało opublikowane przed po ujawnieniu podatności.

Pole2022-11-11 21:402022-11-11 21:542022-11-11 22:03
nameKB Messages PHP ScriptKB Messages PHP ScriptKB Messages PHP Script
version1.01.01.0
argumentusername/passwordusername/passwordusername/password
input_value'or''=''or''=''or''='
risk222
cvss2_vuldb_basescore6.86.86.8
cvss2_vuldb_tempscore5.85.85.8
cvss2_vuldb_avNNN
cvss2_vuldb_acMMM
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss3_meta_basescore7.38.18.1
cvss3_meta_tempscore6.67.97.9
cvss3_vuldb_basescore7.37.37.3
cvss3_vuldb_tempscore6.66.66.6
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prNNN
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
date1485388800 (2017-01-26)1485388800 (2017-01-26)1485388800 (2017-01-26)
locationExploit-DBExploit-DBExploit-DB
typeExploitExploitExploit
urlhttps://www.exploit-db.com/exploits/41168/https://www.exploit-db.com/exploits/41168/https://www.exploit-db.com/exploits/41168/
identifierEDB-ID 41168EDB-ID 41168EDB-ID 41168
person_nameIhsan SencanIhsan SencanIhsan Sencan
availability111
date1485388800 (2017-01-26)1485388800 (2017-01-26)1485388800 (2017-01-26)
publicity111
urlhttps://www.exploit-db.com/exploits/41168/https://www.exploit-db.com/exploits/41168/https://www.exploit-db.com/exploits/41168/
developer_nameIhsan SencanIhsan SencanIhsan Sencan
price_0day$0-$5k$0-$5k$0-$5k
exploitdb411684116841168
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rlNDNDND
cvss2_vuldb_rcURURUR
cvss3_vuldb_ePPP
cvss3_vuldb_rlXXX
cvss3_vuldb_rcRRR
typeProgramming Language SoftwareProgramming Language SoftwareProgramming Language Software
exploitdb_date1485388800 (2017-01-26)1485388800 (2017-01-26)1485388800 (2017-01-26)
cwe89 (sql injection)89 (sql injection)89 (sql injection)
cveCVE-2017-20128CVE-2017-20128CVE-2017-20128
responsibleVulDBVulDBVulDB
cve_assigned1656367200 (2022-06-28)1656367200 (2022-06-28)1656367200 (2022-06-28)
cve_nvd_summaryA vulnerability has been found in KB Messages PHP Script 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.A vulnerability has been found in KB Messages PHP Script 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.A vulnerability has been found in KB Messages PHP Script 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
cvss3_nvd_avNN
cvss3_nvd_acLL
cvss3_nvd_prNN
cvss3_nvd_uiNN
cvss3_nvd_sUU
cvss3_nvd_cHH
cvss3_nvd_iHH
cvss3_nvd_aHH
cvss3_cna_avNN
cvss3_cna_acLL
cvss3_cna_prNN
cvss3_cna_uiNN
cvss3_cna_sUU
cvss3_cna_cLL
cvss3_cna_iLL
cvss3_cna_aLL
cve_cnaVulDBVulDB
cvss3_nvd_basescore9.89.8
cvss3_cna_basescore7.37.3

◂ PoprzedniPrzeglądKolejny ▸

Interested in the pricing of exploits?

See the underground prices here!