Security readout for executives and security teams
Plain-English summary
CVE-2017-17829 reports SQL injection in a Bus Booking Script administration area. If an organization runs this software, attackers may be able to manipulate database queries through specific admin parameters. The source bundle does not identify a vendor, affected versions, CVSS score, official patch, or active exploitation.
Executive priority
Prioritize confirmation of exposure before emergency response. If the script is present and admin routes are reachable, treat remediation as high priority because SQL injection can affect sensitive booking, account, or operational data.
Technical view
The CVE describes SQL injection through admin/view_seatseller.php sp_id and admin/view_member.php memid. The affected product is named only as Bus Booking Script, with no version range or CPE data. Available sources provide limited metadata and one public vulnerability report reference.
Likely exposure
Exposure is likely limited to organizations that deployed the referenced Bus Booking Script, especially where admin routes are reachable from untrusted networks. The bundle does not confirm whether authentication is required, which versions are affected, or whether hosted copies remain common.
Exploitation context
The vulnerability is publicly documented, but the source bundle does not provide evidence of active exploitation. It is not listed as CISA KEV in the provided data. SQL injection can be serious, but operational urgency depends on confirmed deployment and reachability.
Researcher notes
Key gaps are vendor identity, affected versions, authentication context, CVSS, and patch status. Do not assume exploit prevalence from this bundle alone. Focus validation on code review and asset discovery rather than public exploit claims.
Mitigation direction
- Inventory any Bus Booking Script deployments and exposed admin paths.
- Check project or vendor guidance for any available patched release.
- Restrict admin access to trusted users and trusted network locations.
- Use parameterized database queries for sp_id and memid handling.
- Review logs for suspicious access to the named admin PHP files.
Validation and detection
- Search asset inventory for Bus Booking Script installations.
- Confirm whether admin/view_seatseller.php and admin/view_member.php exist.
- Determine whether the admin interface is internet-accessible.
- Review source code for direct SQL use of sp_id or memid.
- Verify any applied fix removes unsafe query construction.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-17829 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/d4wner/Vulnerabilities-Report/blob/master/Bus-Booking-Script.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.