CVE-2017-17097

gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.

• CWE-640

• https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fecPatch, Third Party Advisory
• https://s1.gps-server.net/changelog.txtRelease Notes, Vendor Advisory
• https://www.exploit-db.com/exploits/43431/Exploit, Third Party Advisory, VDB Entry
• https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fecPatch, Third Party Advisory
• https://s1.gps-server.net/changelog.txtRelease Notes, Vendor Advisory
• https://www.exploit-db.com/exploits/43431/Exploit, Third Party Advisory, VDB Entry

Published

Jan 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17091wp-admin/user-new.php in WordPress before 4.9.1 sets the new…
• CVE-2017-17092wp-includes/functions.php in WordPress before 4.9.1 does not…
• CVE-2017-17093wp-includes/general-template.php in WordPress before 4.9.1 d…
• CVE-2017-17094wp-includes/feed.php in WordPress before 4.9.1 does not prop…
• CVE-2017-17095tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote at…
• CVE-2017-17096Cross-site scripting (XSS) vulnerability in the Content Card…
• CVE-2017-17098The writeLog function in fn_common.php in gps-server.net GPS…
• CVE-2017-17099There exists an unauthenticated SEH based Buffer Overflow vu…
• CVE-2017-1710A vulnerability in the Service Assistant GUI in IBM Storwize…
• CVE-2017-17101An issue was discovered in Apexis APM-H803-MPC software, as …
• CVE-2017-17102Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $_R…
• CVE-2017-17103Fiyo CMS 2.0.7 has SQL injection in /apps/app_user/sys_user.…