critical9.8Public exploit code
CVE-2017-15579
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHP Melody 2.7.3 - Multiple Vulnerabilities2017-10-09 · webapps · php
Impact
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phpsugar | Php Melody | through 2.7.2 |