CVE-2017-7997 Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter...
CriticalCVSS 9.8
EPSS 19.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter to (2) webapp/users/blhistory.jsp or (3) webapp/users/prhistory.jsp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gespage | < 7.4.9 | 7.4.9 |
References
- 20180105 [CVE-2017-7997] Gespage SQL Injection vulnerability exploit mailing-list third-party-advisory
- sysdream.com exploit third-party-advisory
- 43447 exploit third-party-advisory vdb-entry