CVE-2017-17957
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the 'fid' parameter in my_wishlist.php in PHP Multivendor Ecommerce. Attackers can potentially access, modify, or delete database content. All users running vulnerable versions of this software are affected.
💻 Affected Systems
- PHP Scripts Mall PHP Multivendor Ecommerce
📦 What is this software?
Php Multivendor Ecommerce by Php Multivendor Ecommerce Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, privilege escalation, or data manipulation in the ecommerce database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
SQL injection via GET/POST parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - check vendor updates
Vendor Advisory: Not publicly documented
Restart Required: No
Instructions:
1. Update to latest version from PHP Scripts Mall. 2. Replace my_wishlist.php with patched version. 3. Validate all user inputs are properly sanitized.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to restrict 'fid' to numeric values only
In my_wishlist.php, add: if(!is_numeric($_GET['fid'])) { die('Invalid parameter'); }
WAF Rule
allBlock SQL injection patterns targeting the fid parameter
ModSecurity rule: SecRule ARGS:fid "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Block external access to my_wishlist.php via firewall rules
- Implement database user with minimal required permissions
🔍 How to Verify
Check if Vulnerable:
Test my_wishlist.php with payload: ?fid=1' OR '1'='1Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test with same payload - should return error or no SQL execution📡 Detection & Monitoring
Log Indicators:
- SQL errors in PHP/application logs
- Unusual database queries from web server IP
Network Indicators:
- HTTP requests with SQL keywords in fid parameter
- Multiple rapid requests to my_wishlist.php
SIEM Query:
source="web_logs" AND uri="*my_wishlist.php*" AND (param="*fid=*'*" OR param="*fid=*%27*")