CVE-2017-17721

CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, or workorderstatus parameter.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-12-18

Last modified

2024-08-05

Weaknesses

CWE-89

Affected products

• Beims Contractorweb .net (Zuuse)

References

• https://0day.today/exploit/29277
• https://becomepentester.blogspot.com/2017/12/ZUUSE-BEIMS-ContractorWeb-SQLInjection-CVE-2017-17721.html
• https://cxsecurity.com/issue/WLB-2017120155
• https://packetstormsecurity.com/files/145511/BEIMS-ContractorWeb-5.18.0.0-SQL-Injection.html
• https://www.cyber-security.ro/blog/2017/12/20/beims-contractorweb-5-18-0-0-sql-injection/
• https://www.exploit-db.com/exploits/43379/