CVE-2017-17618
📋 TL;DR
CVE-2017-17618 is a critical SQL injection vulnerability in Kickstarter Clone Script 2.0 that allows attackers to execute arbitrary SQL commands via the investcalc.php projid parameter. This affects all deployments of this specific crowdfunding script, potentially compromising the entire database. Attackers can steal sensitive data, modify database contents, or gain administrative access.
💻 Affected Systems
- Kickstarter Clone Script
📦 What is this software?
Kickstarter Clone Script by Kickstarter Clone Script Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data extraction including user credentials, payment information, and project data, followed by authentication bypass and privilege escalation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection, though other vulnerabilities may still exist.
🎯 Exploit Status
Multiple public exploit scripts available requiring minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
1. Replace vulnerable investcalc.php with patched version if available
2. Implement parameterized queries
3. Add input validation for projid parameter
4. Test thoroughly before deployment
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure projid parameter contains only numeric values
// PHP example: if(!is_numeric($_GET['projid'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
# ModSecurity example: SecRule ARGS:projid "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Isolate the vulnerable system behind a WAF with SQL injection protection rules
- Restrict network access to only necessary IP addresses and implement strict monitoring
🔍 How to Verify
Check if Vulnerable:
Test investcalc.php with SQL injection payloads like: investcalc.php?projid=1' OR '1'='1Check Version:
Check script documentation or configuration files for version informationVerify Fix Applied:
Attempt SQL injection tests and verify they are blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual database query patterns
- Multiple failed login attempts from single IP
- SQL syntax errors in application logs
Network Indicators:
- Unusual POST/GET requests to investcalc.php with SQL keywords
- Traffic spikes to vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="*investcalc.php*" AND (query="*UNION*" OR query="*SELECT*" OR query="*OR '1'='1*")