CVE-2017-15081

published 2017-10-24

CVE-2017-15081: In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.

Priority P3 56 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
phpsugar	php_melody	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://x.x.x.x/playlists.php?playlist=↗

command ' UNION SELECT null,concat(0x223c2f613e3c2f64 69763e3c2f6469763e,version(),0 x3c212d2d),null,null,null,null ,null,null,null,null,null-- -↗

• → Monitor HTTP requests to playlists.php for SQL injection patterns in the 'playlist' GET parameter, particularly UNION SELECT payloads and SQL comment sequences (-- -). ↗
• → Look for hex-encoded strings (e.g. 0x223c2f613e...) in query parameters to playlists.php, indicative of obfuscated UNION-based SQL injection attempts. ↗

• · The vulnerable application is PHP Melody CMS version 2.6.1 specifically; other versions may not be affected by this exact injection point. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89