CVE-2021-47915

Summary

PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system.

Affected Software

Weaknesses

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://www.vulnerability-lab.com/get_content.php?id=2295
• https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/
• https://www.phpsugar.com/phpmelody.html
• https://www.vulncheck.com/advisories/php-melody-sql-injection-vulnerability-via-edit-video-parameter

• ←Previous
• Next→