Quantum Secular Labs / Blog / Advisories

CVE-2017-12757: Ambittechnologies Itech B2b Script: SQL injection

CVE-2017-12757 is rated critical with a CVSS v3.0 base score of 9.8 and affects Ambittechnologies Itech B2b Script, along with 11 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Certain Ambit Technologies Pvt. Ltd products are affected by: SQL Injection. This affects iTech B2B Script 4.42i and Tech Business Networking Script 8.26i and Tech Caregiver Script 2.71i and Tech Classifieds Script 7.41i and Tech Dating Script 3.40i and Tech Freelancer Script 5.27i and Tech Image Sharing Script 4.13i and Tech Job Script 9.27i and Tech Movie Script 7.51i and Tech Multi Vendor Script 6.63i and Tech Social Networking Script 3.08i and Tech Travel Script 9.49. The impact is: Code execution (remote).

Severity breakdown

CVSS v3.0 9.8: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected products

  • Ambittechnologies Itech B2b Script: 4.42i
  • Ambittechnologies Itech Business Networking Script: 8.26i
  • Ambittechnologies Itech Caregiver Script: 2.71i
  • Ambittechnologies Itech Classifieds Script: 7.41i
  • Ambittechnologies Itech Dating Script: 3.40i
  • Ambittechnologies Itech Freelancer Script: 5.27i
  • Ambittechnologies Itech Image Sharing Script: 4.13i
  • Ambittechnologies Itech Job Script: 9.27i
  • Ambittechnologies Itech Movie Script: 7.51i
  • Ambittechnologies Itech Multi Vendor Script: 6.63i
  • Ambittechnologies Itech Social Networking Script: 3.08i
  • Ambittechnologies Itech Travel Script: 9.49

References