CVE-2017-14703
📋 TL;DR
CVE-2017-14703 is a critical SQL injection vulnerability in Cash Back Comparison Script 1.0 that allows remote attackers to execute arbitrary SQL commands via the PATH_INFO parameter in the search functionality. This affects all users running version 1.0 of the software, potentially compromising the entire database and web application.
💻 Affected Systems
- Cash Back Comparison Script
📦 What is this software?
Cash Back Comparison by Cashbackcomparisonscript
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, and potential remote code execution through database functions.
Likely Case
Attackers extract sensitive user data (passwords, personal information), modify database content, or gain administrative access to the application.
If Mitigated
With proper input validation and parameterized queries, SQL injection attempts are blocked and logged without affecting system functionality.
🎯 Exploit Status
Public exploit code is available and demonstrates simple exploitation via crafted URLs. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch exists. Recommended action is to upgrade to a secure alternative or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize PATH_INFO parameter before processing SQL queries
Modify search.php to validate and sanitize $_SERVER['PATH_INFO'] using preg_replace('/[^a-zA-Z0-9\-_\/]/', '', $path_info)
Web Application Firewall Rule
allBlock SQL injection patterns in PATH_INFO parameter
Add WAF rule: SecRule REQUEST_URI "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt in PATH_INFO'"
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with SQL injection detection rules
- Restrict network access to only trusted IP addresses using firewall rules
🔍 How to Verify
Check if Vulnerable:
Test by accessing /search/ followed by SQL injection payload like /search/' OR '1'='1 and checking for database errors or unexpected resultsCheck Version:
Check script version in admin panel or review source code for version markersVerify Fix Applied:
Attempt SQL injection payloads and verify they are blocked or sanitized without affecting legitimate search functionality📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in access logs
- Database error messages in application logs
- Multiple failed search attempts with special characters
Network Indicators:
- HTTP requests with SQL keywords in PATH_INFO parameter
- Unusual database connection patterns from web server
SIEM Query:
source="web_access.log" AND (uri="*search/*" AND (uri="*UNION*" OR uri="*SELECT*" OR uri="*OR '1'='1*" OR uri="*--*"))