Vulnerability Description
Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter to (2) webapp/users/blhistory.jsp or (3) webapp/users/prhistory.jsp.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gespage | Gespage | < 7.4.9 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2018/Jan/14ExploitMailing ListThird Party Advisory
- https://sysdream.com/news/lab/2018-01-02-cve-2017-7997-gespage-sql-injection-vulExploitThird Party Advisory
- https://www.exploit-db.com/exploits/43447/ExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2018/Jan/14ExploitMailing ListThird Party Advisory
- https://sysdream.com/news/lab/2018-01-02-cve-2017-7997-gespage-sql-injection-vulExploitThird Party Advisory
- https://www.exploit-db.com/exploits/43447/ExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2017-7997?
CVE-2017-7997 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter...
How severe is CVE-2017-7997?
CVE-2017-7997 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-7997?
Check the references section above for vendor advisories and patch information. Affected products include: Gespage Gespage.