CVE-2017-17959
📋 TL;DR
This vulnerability allows attackers to execute arbitrary SQL commands through the seller-view.php script's usid parameter in PHP Multivendor Ecommerce. It affects all installations of this specific e-commerce software that haven't been patched, potentially compromising the entire database.
💻 Affected Systems
- PHP Scripts Mall PHP Multivendor Ecommerce
📦 What is this software?
Php Multivendor Ecommerce by Php Multivendor Ecommerce Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion; potential remote code execution via database functions; full system takeover.
Likely Case
Unauthorized access to sensitive data including customer information, order details, and seller credentials; potential privilege escalation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Simple SQL injection via GET parameter; exploit tools widely available
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - check vendor updates
Vendor Advisory: https://www.phpjabbers.com/
Restart Required: No
Instructions:
1. Update to latest version from vendor
2. Replace seller-view.php with patched version
3. Validate all user inputs
4. Use parameterized queries
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize usid parameter
Add: if(!is_numeric($_GET['usid'])) { die('Invalid input'); }
WAF Rule
allBlock SQL injection patterns in usid parameter
ModSecurity rule: SecRule ARGS:usid "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Disable or remove seller-view.php script if not required
- Implement web application firewall with SQL injection protection
🔍 How to Verify
Check if Vulnerable:
Test seller-view.php with payload: seller-view.php?usid=1' OR '1'='1Check Version:
Check script headers or vendor documentationVerify Fix Applied:
Test with same payload; should return error or no data📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in logs
- Unusual usid parameter values
- Multiple failed SQL queries
Network Indicators:
- SQL keywords in GET parameters
- Unusual database query patterns
SIEM Query:
web_logs | where url contains "seller-view.php" and (url contains "' OR" or url contains "UNION" or url contains "SELECT" or url contains "--")