CVE-2017-20168 json
jfm-so piWallet api.php sql injection
published 2023-01-11 3 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11165
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
A vulnerability was found in jfm-so piWallet. It has been rated as critical. Affected by this issue is some unknown functionality of the file api.php. The manipulation of the argument key leads to sql injection. The patch is identified as b420f8c4cbe7f06a34d1b05e90ee5cdfe0aa83bb. It is recommended to apply a patch to fix this issue. VDB-218006 is the identifier assigned to this vulnerability.
Patch / fix
- piwallet_project piwallet 2017-03-26
- github.com/jfm-so/piWallet@b420f8c commit
- github.com/jfm-so/piWallet#23 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 5.2 | AV:A/AC:L/Au:S/C:P/I:P/A:P |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- jfm-so piWallet
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/jfm-so/piWallet/pull/23
issue-tracking, patch
-
github.com
/jfm-so/piWallet/commit/b420f8c4cbe7f06a34d1b05e90ee5cdfe0aa83bb
patch
-
vuldb.com
/?id.218006
vdb-entry, technical-description, permissions-required, third-party-advisory
-
vuldb.com
/?ctiid.218006
signature, permissions-required, third-party-advisory
Sources
- CVE List CVE-2017-20168
- NVD CVE-2017-20168
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.