Security readout for executives and security teams
Plain-English summary
This CVE describes a SQL injection in tianchoy/blog, where the id value sent to view.php could affect database queries. If an exposed site runs the affected code, attackers might access or alter database-backed content. The source bundle does not provide CVSS, a vendor advisory, or a confirmed patch.
Executive priority
Prioritize quickly only if your organization runs this application or inherited similar code. The vulnerability class is serious, but business urgency cannot be rated confidently without confirming exposure, data sensitivity, and whether a maintained fix exists.
Technical view
CVE-2017-14345 is reported as SQL injection in tianchoy/blog through 2017-09-12 via the id parameter to view.php. The public record has sparse product metadata, no CWE mapping, and no CVSS score. The provided sources do not describe a fixed version, mitigation, or active exploitation.
Likely exposure
Exposure appears limited to deployments of tianchoy/blog code through 2017-09-12 where view.php is reachable and accepts an id parameter. The CVE record does not provide CPEs, package coordinates, or reliable vendor/product metadata, so asset matching may require source-code or application inventory checks.
Exploitation context
The bundle includes a public GitHub reference for the SQL injection report. It does not include CISA KEV listing, proof of active exploitation, exploit prevalence, or scanning telemetry. Treat exploitation status as unconfirmed based on the supplied evidence.
Researcher notes
The public metadata is thin: no CVSS, no CPE, no CWE, no named fixed version, and affected product fields are placeholders. Analysis should focus on confirming code lineage, route exposure, and whether the GitHub reference accurately matches deployed source.
Mitigation direction
- Check the project or vendor repository for a maintained fixed version or advisory.
- Retire or isolate any exposed tianchoy/blog deployment if no supported fix exists.
- Review view.php database access and replace unsafe query construction with parameterized queries.
- Restrict public access to affected routes until code review and remediation are complete.
- Monitor database and web logs for suspicious id-parameter errors or unusual query behavior.
Validation and detection
- Inventory web assets for tianchoy/blog code or copied view.php implementations.
- Confirm whether view.php is internet reachable and accepts an id parameter.
- Review the affected handler for unsanitized id values used in SQL queries.
- Verify any remediation in a staging environment using non-destructive security testing.
- Check logs around the route for database errors or abnormal request patterns.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-14345 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/imsebao/404team/blob/master/tianchoy-blog-sql.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.