5.5med
CVE-2017-20168
jfm-so piWallet api.php sql injection
Published 3 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 52%
Public exploits
0
none known
Summary
A vulnerability was found in jfm-so piWallet. It has been rated as critical. Affected by this issue is some unknown functionality of the file api.php. The manipulation of the argument key leads to sql injection. The patch is identified as b420f8c4cbe7f06a34d1b05e90ee5cdfe0aa83bb. It is recommended to apply a patch to fix this issue. VDB-218006 is the identifier assigned to this vulnerability.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction (EPSS)
0.66% probability of exploitation in the next 30 days, higher than 52% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 5.2 | AV:A/AC:L/Au:S/C:P/I:P/A:P |
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 2.0 | 5.2 | AV:A/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- jfm-so piWallet
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- vuldb.com /?id.218006 · vdb-entry, technical-description, x_transferred
- vuldb.com /?ctiid.218006 · signature, permissions-required, x_transferred
- github.com /jfm-so/piWallet/pull/23 · issue-tracking, x_transferred
- github.com /jfm-so/piWallet/commit/b420f8c4cbe7f06a34d1b05e90ee5cdfe0aa83bb · patch, x_transferred
Sources
- CVE List: CVE-2017-20168
- NVD: CVE-2017-20168
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.