CVE-2017-7997

published 2018-01-08

CVE-2017-7997: Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to…

Priority P2 74 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter to (2) webapp/users/blhistory.jsp or (3) webapp/users/prhistory.jsp.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
gespage	gespage	< 7.4.9	7.4.9

Detection & IOCs extracted from sources · hover to see the quote

path /ges/webapp/users/prnow.jsp↗

path /ges/webapp/users/blhistory.jsp↗

path /ges/webapp/users/prhistory.jsp↗

command show_prn=1');SELECT PG_SLEEP(3)--↗

command show_prn=1');SELECT PG_SLEEP(6)--↗

command show_prn=A-PRINTER-ON-THE-WEB-LIST');UPDATE param_gespage SET param_value='8cb2237d0679ca88db6464eac60da96345513964' WHERE param_id='admin_pwd'--↗

port 7181↗

port 7180↗

• → Detect time-based blind SQLi attempts against Gespage by monitoring POST requests to prnow.jsp, blhistory.jsp, or prhistory.jsp containing SQL sleep/stacked-query payloads (e.g., PG_SLEEP or ');) in the show_prn or show_month parameters. ↗
• → Alert on POST requests to /gespage/webapp/users/prnow.jsp with show_prn values containing SQL stacked-query comment sequences such as ');...-- or UPDATE/SELECT statements. ↗
• → Detect sqlmap usage against Gespage endpoints by monitoring for requests to /gespage/users/prnow.jsp with --data containing 'A-PRINTER-ON-THE-WEB-LIST' and PostgreSQL-specific technique flags. ↗
• → Flag POST requests to Gespage JSP pages originating from unauthenticated sessions or with a JSESSIONID cookie that subsequently attempt to access /admin/ — indicative of admin password reset via SQL injection. ↗

• · Exploitation requires an authenticated session (valid JSESSIONID cookie of an existing user); unauthenticated exploitation is not demonstrated in the PoC. ↗
• · The backend database is PostgreSQL; SQL injection payloads use PostgreSQL-specific syntax (PG_SLEEP, stacked queries). Detection rules should account for PostgreSQL-specific patterns. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89