cbcvebase.
CVE-2017-17110
published 2017-12-11

CVE-2017-17110: Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.

PriorityP265critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
8.58%
94.4th percentile
Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.

Affected

1 ranges
VendorProductVersion rangeFixed in
techno_portfolio_management_panel_projecttechno_portfolio_management_panel——

Detection & IOCsextracted from sources · hover to see the quote

path/single.php↗
command-14++/*!08888UNION*/(/*!08888SELECT*/0x283129,0x283229,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),0x283429,0x283529,0x283629,0x283729,(/*!08888SELECT*/+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+/*!08888FROM*/+INFORMATION_SCHEMA.TABLES+/*!08888WHERE*/+TABLE_SCHEMA=DATABASE()),0x283929,0x28313029,0x28313129,0x28313229,0x28313329)--+-↗
  • →Monitor HTTP requests to single.php with an 'id' parameter containing SQL injection patterns, specifically inline comment-based UNION SELECT bypass syntax (/*!08888UNION*/, /*!08888SELECT*/) combined with negative integer IDs (e.g., -14). ↗
  • →Detect use of MySQL/MariaDB versioned comment obfuscation in query strings: /*!08888UNION*/ and /*!08888SELECT*/ are characteristic of this exploit's WAF-bypass technique. ↗
  • →Alert on requests to single.php where the 'id' parameter contains INFORMATION_SCHEMA.TABLES enumeration payloads, indicating active database reconnaissance. ↗
  • →The SQL injection payload terminates with --+- (comment sequence); flag URL-decoded query strings on single.php ending with this pattern combined with UNION SELECT. ↗
  • ·The exploit was tested against a live demo instance; the extracted database credentials and schema belong to that demo environment and should not be treated as indicators of a specific production compromise. ↗
  • ·The CVE entry notes the vulnerability is in version 1.0 only; detections should be scoped to deployments of Techno Portfolio Management Panel 1.0. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.