CVE-2017-20171

CVE-2017-20171 is a critical SQL injection vulnerability found in PrivateSky's apersistence project, specifically within the db/sql/mysqlUtils.js file. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to full compromise of the affected system. With a CVSS score of 9.8 (Critical), it presents a high risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation (KEV: No) and no public exploit code (Metasploit, Nuclei, ExploitDB: None), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation. A patch (954425f61634b556fe644837a592a5b8fcfca068) is available and strongly recommended for immediate application.