CVE-2017-3181— Multiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2017-3181
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query
Source: NVD (National Vulnerability Database)
Vulnerability Description
Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The following products and versions are affected: TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 The following components are affected: TIBCO Spotfire Client TIBCO Spotfire Web Player Client
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
多款TIBCO产品SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TIBCO Spotfire Analyst等都是美国TIBCO软件公司的产品。Spotfire Analyst是一套数据分析和挖掘平台；Spotfire Desktop是一套专为探索数据设计的分析软件。 多款TIBCO产品中存在多个SQL注入漏洞，该漏洞源于程序在使用SQL语句查询之前，没有正确的过滤用户提交的输入。远程攻击者可利用该漏洞控制应用程序，访问或修改数据或利用底层数据库中的潜在漏洞。以下产品和版本受到影响：TIBCO Spotfire Analyst 7.7.0版本；TIBCO Spotfi
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TIBCO | Spotfire Analyst | 7.7.0 | - | |
| TIBCO | Spotfire Connectors | 7.6.0 | - | |
| TIBCO | Spotfire Deployment Kit | 7.7.0 | - | |
| TIBCO | Spotfire Desktop | 7.6.0 | - | |
| TIBCO | Spotfire Desktop Developer Edition | 7.7.0 | - | |
| TIBCO | Spotfire Desktop Language Packs | 7.6.0 | - | |
| TIBCO | Spotfire Web Player Client | N/A | - | |
| TIBCO | Spotfire Client | N/A | - |
II. Public POCs for CVE-2017-3181
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-3181
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: TIBCO
Same weakness: CWE-89
- CVE-2021-47941
WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss - CVE-2021-47930
Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthentic - CVE-2021-47928
Opencart TMD Vendor System 3.x Blind SQL Injection via produ - CVE-2026-8231
CodeAstro Online Catering Ordering System deleteorder.php sq - CVE-2025-14179
SQL injection in pdo_firebird via NUL bytes in quoted string
V. Comments for CVE-2017-3181
No comments yet