CVE-2017-17632
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands via the findcity.php q parameter in Responsive Events And Movie Ticket Booking Script 3.2.1. Attackers can potentially access, modify, or delete database content. All users running this specific version of the script are affected.
💻 Affected Systems
- Responsive Events And Movie Ticket Booking Script
📦 What is this software?
Responsive Events And Movie Ticket Booking Script by Responsive Events And Movie Ticket Booking Script Project
View all CVEs affecting Responsive Events And Movie Ticket Booking Script →
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, and potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access and extraction of sensitive information like user credentials, payment details, and personal data.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Multiple public exploit scripts available with simple HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd input validation to sanitize the q parameter before processing
Modify findcity.php to use prepared statements with parameterized queries
WAF Rule Implementation
allAdd web application firewall rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:q "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable system
- Add strict input validation and output encoding in the application code
🔍 How to Verify
Check if Vulnerable:
Test by sending a crafted SQL injection payload to /findcity.php?q=test' OR '1'='1Check Version:
Check script version in admin panel or configuration filesVerify Fix Applied:
Test with SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- HTTP requests with SQL keywords in q parameter
Network Indicators:
- HTTP requests containing SQL injection patterns in URL parameters
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND (url="*findcity.php*" AND (param="*q=*' OR*" OR param="*q=*' UNION*" OR param="*q=*' SELECT*"))🔗 References
- https://packetstormsecurity.com/files/145342/Responsive-Events-And-Movie-Ticket-Booking-Script-3.2.1-SQL-Injection.html
- https://www.exploit-db.com/exploits/43300/
- https://packetstormsecurity.com/files/145342/Responsive-Events-And-Movie-Ticket-Booking-Script-3.2.1-SQL-Injection.html
- https://www.exploit-db.com/exploits/43300/
