Sign-up

ID

VAR-201709-0609


CVE

CVE-2017-14600


TITLE

Pragyan CMS In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-008159

DESCRIPTION

Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injection in cms/admin.lib.php via $_GET['del_black'], resulting in Information Disclosure. Pragyan CMS is a multi-user, modular PHP and MySQL-based content management system (CMS). The system supports custom built-in frameworks, user group permission management, search engine optimization, and more. A remote attacker could use this vulnerability to obtain information using $ _GET ['del_black']

Trust: 2.16

sources: NVD: CVE-2017-14600 // JVNDB: JVNDB-2017-008159 // CNVD: CNVD-2017-34576

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-34576

AFFECTED PRODUCTS

vendor:pragyan cmsmodel:pragyan cmsscope:eqversion:3.0

Trust: 2.4

vendor:pragyanmodel:cms pragyan cmsscope:eqversion:3.0

Trust: 0.6

sources: CNVD: CNVD-2017-34576 // JVNDB: JVNDB-2017-008159 // CNNVD: CNNVD-201709-935 // NVD: CVE-2017-14600

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-14600
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-14600
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-34576
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201709-935
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2017-14600
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-34576
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2017-14600
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.2
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2017-34576 // JVNDB: JVNDB-2017-008159 // CNNVD: CNNVD-201709-935 // NVD: CVE-2017-14600

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.8

sources: JVNDB: JVNDB-2017-008159 // NVD: CVE-2017-14600

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-935

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201709-935

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-008159

PATCH
title:Found 2 SQL injection vulnerabilities #228url:https://github.com/delta/pragyan/issues/228
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2017-008159

EXTERNAL IDS
db:NVDid:CVE-2017-14600
Trust: 3.0
db:JVNDBid:JVNDB-2017-008159
Trust: 0.8
db:CNVDid:CNVD-2017-34576
Trust: 0.6
db:CNNVDid:CNNVD-201709-935
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-34576 // 
            
            
            
            JVNDB: JVNDB-2017-008159 // 
            
            
            
            CNNVD: CNNVD-201709-935 // 
            
            
            
            NVD: CVE-2017-14600

REFERENCES
url:https://github.com/delta/pragyan/issues/228
Trust: 2.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14600
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-14600
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2017-34576 // 
            
            
            
            JVNDB: JVNDB-2017-008159 // 
            
            
            
            CNNVD: CNNVD-201709-935 // 
            
            
            
            NVD: CVE-2017-14600

SOURCES
db:CNVDid:CNVD-2017-34576
db:JVNDBid:JVNDB-2017-008159
db:CNNVDid:CNNVD-201709-935
db:NVDid:CVE-2017-14600

LAST UPDATE DATE
2025-04-20T23:35:46.353000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-34576date:2017-11-20T00:00:00
db:JVNDBid:JVNDB-2017-008159date:2017-10-11T00:00:00
db:CNNVDid:CNNVD-201709-935date:2017-09-28T00:00:00
db:NVDid:CVE-2017-14600date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:CNVDid:CNVD-2017-34576date:2017-11-20T00:00:00
db:JVNDBid:JVNDB-2017-008159date:2017-10-11T00:00:00
db:CNNVDid:CNNVD-201709-935date:2017-09-28T00:00:00
db:NVDid:CVE-2017-14600date:2017-09-19T07:29:00.287