Security readout for executives and security teams
Plain-English summary
Pragyan CMS 3.0 has a reported SQL injection issue tied to the forwhat query parameter in cms/admin.lib.php. The published record says it can lead to information disclosure. There is no CVSS score, KEV listing, or confirmed active exploitation in the provided sources.
Executive priority
Treat this as a targeted exposure check rather than an emergency internet-wide event. If Pragyan CMS 3.0 is present, prioritize validation because SQL injection can expose sensitive data. If it is not present, no action is indicated beyond normal inventory hygiene.
Technical view
CVE-2017-14601 is described as a Boolean-based SQL injection in Pragyan CMS v3.0 involving $_GET['forwhat'] in cms/admin.lib.php. The stated impact is information disclosure. The source bundle does not define authentication requirements, exposed routes, vulnerable query context, patch version, or compensating controls.
Likely exposure
Exposure is most likely limited to organizations running Pragyan CMS v3.0. Risk increases if the affected CMS administration functionality is reachable from untrusted networks. The provided affected-product metadata is incomplete, so validate against actual deployed software and code paths.
Exploitation context
The CVE is not listed in KEV, and the provided sources do not claim active exploitation. Public details identify the vulnerable parameter and file, but the bundle does not provide reliable evidence about exploit maturity, authentication requirements, or real-world targeting.
Researcher notes
The record is sparse: no CVSS, CWE, CPE, authentication detail, or patch metadata is included. The useful confirmed facts are product/version, vulnerable parameter/file, injection class, and information-disclosure impact. Avoid assuming broader versions or active exploitation without additional vendor evidence.
Mitigation direction
- Identify any Pragyan CMS deployments and confirm version 3.0 usage.
- Check Pragyan project guidance and issue history for an official fix or upgrade path.
- Restrict access to CMS administration paths to trusted users and networks.
- Review application input handling around the affected parameter if maintaining a fork.
- Increase monitoring for suspicious requests to Pragyan CMS administrative paths.
Validation and detection
- Inventory web assets for Pragyan CMS and confirm exact deployed versions.
- Review source or vendor code for use of forwhat in cms/admin.lib.php.
- Check access logs for unusual requests involving the affected parameter.
- Confirm whether administrative paths are internet-accessible.
- Document any vendor fix, local patch, or compensating access control in place.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-14601 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/delta/pragyan/issues/228CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.