Security readout for executives and security teams
Plain-English summary
CVE-2017-9360 reports a SQL injection issue in WebsiteBaker v2.10.0. For executives, the business concern is potential compromise of website data if an affected site exposes the vulnerable account details page. The supplied sources do not provide severity scoring, patch status, or evidence of active exploitation.
Executive priority
Prioritize confirmation of exposure before urgent remediation decisions. If WebsiteBaker v2.10.0 is internet-facing, treat it as a near-term risk because SQL injection can threaten customer or operational data, even though this record lacks severity and exploitation evidence.
Technical view
The CVE record describes SQL injection in WebsiteBaker v2.10.0 at /account/details.php. The supplied data does not include a CVSS vector, CWE mapping, affected CPEs, vulnerable parameter, authentication requirement, or remediation details. Treat impact and exploitability as insufficiently characterized from the available evidence.
Likely exposure
Exposure is most likely limited to public or internal websites running WebsiteBaker v2.10.0 where /account/details.php is present and reachable. The supplied evidence does not confirm whether authentication is required or whether other versions are affected.
Exploitation context
The CVE has a public reference, but it is not listed as CISA KEV and the supplied sources do not state active exploitation. SQL injection can affect database confidentiality or integrity, but this specific record lacks confirmed exploit conditions and impact detail.
Researcher notes
The source bundle is sparse. Do not assume affected versions beyond WebsiteBaker v2.10.0, and do not assume unauthenticated exploitability. The original public reference may contain technical details, but the supplied structured CVE data does not capture parameter, privilege, or fix information.
Mitigation direction
- Inventory WebsiteBaker deployments and identify any running v2.10.0.
- Check WebsiteBaker vendor guidance for patched versions or official remediation.
- Restrict access to account-related pages until remediation is confirmed.
- Review web application firewall and database monitoring for SQL injection indicators.
Validation and detection
- Confirm whether /account/details.php exists on each WebsiteBaker deployment.
- Verify the installed WebsiteBaker version from trusted administrative or file sources.
- Review logs for suspicious requests targeting account details functionality.
- Document whether the application is public-facing, internal, or decommissioned.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-9360 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://jgj212.blogspot.tw/2017/05/a-sql-injection-vulnerability-in.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.