CVE-2017-12757

Vulnerability

Multiple Ambit Technologies Pvt. Ltd products, including iTech B2B Script 4.42i, Tech Business Networking Script 8.26i, Tech Caregiver Script 2.71i, Tech Classifieds Script 7.41i, Tech Dating Script 3.40i, Tech Freelancer Script 5.27i, Tech Image Sharing Script 4.13i, Tech Job Script 9.27i, Tech Movie Script 7.51i, Tech Multi Vendor Script 6.63i, Tech Social Networking Script 3.08i, and Tech Travel Script 9.49, are affected by a SQL injection vulnerability [1]. The flaw exists in various parameters such as myCity, sitterService, age, gender, lastLoginElapsedInDays, yearsOfExperience, collegeLevel, fullPartTime, liveInOut in searchSitter.php, and sitterService, jobType, jobFrequency in searchJob.php [1]. The official description does not specify a particular affected component across all products, but the vulnerability is present in search functionality parameters that are not properly sanitized before being used in SQL queries [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP GET request to one of the affected endpoints with SQL injection payloads in the parameter values [1]. For example, the proof of concept uses a UNION-based injection with the payload -1'+/*!22222union*/+/*!22222select*/+(...) in the myCity parameter [1]. The attacker does not require authentication or a privileged network position; the request can be made over the internet to the publicly accessible scripts [1]. The injection is performed remotely via web requests without any user interaction [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database [1]. This can lead to disclosure of sensitive data, including user credentials and application content [1]. The description further indicates that the impact includes code execution, implying that the SQL injection may be leveraged to achieve remote code execution on the server, likely via techniques such as writing webshells or using the database's file system capabilities [1]. The attacker gains the ability to compromise the database and potentially the entire web server [1].

Mitigation

As of the publication date (2019-05-09), no official patch or fixed version has been identified in the available references [2]. The vendor website (ambit.com) does not appear to provide security updates or advisories for these products [2]. Affected users should consider implementing input validation and parameterized queries as a workaround, or discontinue use of the vulnerable scripts until a fix is provided [1]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of this writing.