CVE-2017-20127 HIGH

CVE-2017-20127: KB Login Authentication Script sql injection

Vendor Unspecified

Product KB Login Authentication Script

Weakness CWE-89 · SQLi

Published July 13, 2022

Last update April 14, 2025

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability was found in KB Login Authentication Script 1.1 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

July 13, 2022 CVE published

April 14, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2017-20127 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2026-13572 itsourcecode Hospital Management System insertbillingrecord.php sql injection CVE-2026-13454 MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter CVE-2026-13566 SourceCodester Class and Exam Timetabling System preview3.php sql injection CVE-2026-13555 itsourcecode Online Hotel Management System controller.php add sql injection CVE-2026-40523 FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php