CVE:CVE-2017-12757
CNNVD:CNNVD-201708-378
Ambit Technologies iTech B2B Script等都是印度Ambit Technologies公司的产品。iTech B2B Script是一套B2B电子商务系统脚本。Tech Caregiver Script是一套医疗行业管理系统脚本。Tech Classifieds Script是一套分类信息展示系统脚本。
多款Ambit Technologies产品中存在SQL注入漏洞。该漏洞源于基于数据库的应用缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令。以下产品及版本受到影响： iTech B2B Script 4.42i版本；Tech Business Networking Script 8.26i版本；Tech Caregiver Script 2.71i版本；Tech Classifieds Script 7.41i版本；Tech Dating Script 3.40i版本；Tech Freelancer Script 5.27i版本；Tech Image Sharing Script 4.13i版本；Tech Job Script 9.27i版本；Tech Movie Script 7.51i版本；Tech Multi Vendor Script 6.63i版本；Tech Social Networking Script 3.08i版本；Tech Travel Script 9.49版本。
solution:Upgrade ambittechnologies itech_b2b_script to a higher version than 4.42i,and avoid the version 4.42i; Upgrade ambittechnologies itech_business_networking_script to a higher version than 8.26i,and avoid the version 8.26i; Upgrade ambittechnologies itech_caregiver_script to a higher version than 2.71i,and avoid the version 2.71i; Upgrade ambittechnologies itech_classifieds_script to a higher version than 7.41i,and avoid the version 7.41i; Upgrade ambittechnologies itech_dating_script to a higher version than 3.40i,and avoid the version 3.40i; Upgrade ambittechnologies itech_freelancer_script to a higher version than 5.27i,and avoid the version 5.27i; Upgrade ambittechnologies itech_image_sharing_script to a higher version than 4.13i,and avoid the version 4.13i; Upgrade ambittechnologies itech_job_script to a higher version than 9.27i,and avoid the version 9.27i; Upgrade ambittechnologies itech_movie_script to a higher version than 7.51i,and avoid the version 7.51i; Upgrade ambittechnologies itech_multi_vendor_script to a higher version than 6.63i,and avoid the version 6.63i; Upgrade ambittechnologies itech_social_networking_script to a higher version than 3.08i,and avoid the version 3.08i; Upgrade ambittechnologies itech_travel_script to a higher version than 9.49,and avoid the version 9.49