Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by gps-server
CVE-2017-17097 (GCVE-0-2017-17097)
Vulnerability from cvelistv5 – Published: 2018-01-02 15:00 – Updated: 2024-08-05 20:43
VLAI
EPSS
VEX
Summary
gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://gist.github.com/pak0s/ea7a80c2614d9cd43cf… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/43431/ | exploitx_refsource_EXPLOIT-DB |
| https://s1.gps-server.net/changelog.txt | x_refsource_MISC |
Date Public
2018-01-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:43:59.612Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://s1.gps-server.net/changelog.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-01-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-07T10:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://s1.gps-server.net/changelog.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-17097",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec",
"refsource": "MISC",
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"name": "https://s1.gps-server.net/changelog.txt",
"refsource": "MISC",
"url": "https://s1.gps-server.net/changelog.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-17097",
"datePublished": "2018-01-02T15:00:00.000Z",
"dateReserved": "2017-12-03T00:00:00.000Z",
"dateUpdated": "2024-08-05T20:43:59.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-17098 (GCVE-0-2017-17098)
Vulnerability from cvelistv5 – Published: 2018-01-02 15:00 – Updated: 2024-08-05 20:43
VLAI
EPSS
VEX
Summary
The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by <?php system($_GET[cmd]); ?> in a login request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://gist.github.com/pak0s/ea7a80c2614d9cd43cf… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/43431/ | exploitx_refsource_EXPLOIT-DB |
| https://s1.gps-server.net/changelog.txt | x_refsource_MISC |
Date Public
2018-01-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:43:59.343Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://s1.gps-server.net/changelog.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-01-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by \u003c?php system($_GET[cmd]); ?\u003e in a login request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-07T10:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://s1.gps-server.net/changelog.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-17098",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by \u003c?php system($_GET[cmd]); ?\u003e in a login request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec",
"refsource": "MISC",
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"name": "https://s1.gps-server.net/changelog.txt",
"refsource": "MISC",
"url": "https://s1.gps-server.net/changelog.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-17098",
"datePublished": "2018-01-02T15:00:00.000Z",
"dateReserved": "2017-12-03T00:00:00.000Z",
"dateUpdated": "2024-08-05T20:43:59.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-17097 (GCVE-0-2017-17097)
Vulnerability from nvd – Published: 2018-01-02 15:00 – Updated: 2024-08-05 20:43
VLAI
EPSS
VEX
Summary
gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://gist.github.com/pak0s/ea7a80c2614d9cd43cf… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/43431/ | exploitx_refsource_EXPLOIT-DB |
| https://s1.gps-server.net/changelog.txt | x_refsource_MISC |
Date Public
2018-01-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:43:59.612Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://s1.gps-server.net/changelog.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-01-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-07T10:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://s1.gps-server.net/changelog.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-17097",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec",
"refsource": "MISC",
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"name": "https://s1.gps-server.net/changelog.txt",
"refsource": "MISC",
"url": "https://s1.gps-server.net/changelog.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-17097",
"datePublished": "2018-01-02T15:00:00.000Z",
"dateReserved": "2017-12-03T00:00:00.000Z",
"dateUpdated": "2024-08-05T20:43:59.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-17098 (GCVE-0-2017-17098)
Vulnerability from nvd – Published: 2018-01-02 15:00 – Updated: 2024-08-05 20:43
VLAI
EPSS
VEX
Summary
The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by <?php system($_GET[cmd]); ?> in a login request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://gist.github.com/pak0s/ea7a80c2614d9cd43cf… | x_refsource_MISC |
| https://www.exploit-db.com/exploits/43431/ | exploitx_refsource_EXPLOIT-DB |
| https://s1.gps-server.net/changelog.txt | x_refsource_MISC |
Date Public
2018-01-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:43:59.343Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://s1.gps-server.net/changelog.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-01-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by \u003c?php system($_GET[cmd]); ?\u003e in a login request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-07T10:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://s1.gps-server.net/changelog.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-17098",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by \u003c?php system($_GET[cmd]); ?\u003e in a login request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec",
"refsource": "MISC",
"url": "https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec"
},
{
"name": "43431",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/43431/"
},
{
"name": "https://s1.gps-server.net/changelog.txt",
"refsource": "MISC",
"url": "https://s1.gps-server.net/changelog.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-17098",
"datePublished": "2018-01-02T15:00:00.000Z",
"dateReserved": "2017-12-03T00:00:00.000Z",
"dateUpdated": "2024-08-05T20:43:59.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}