CVE-2017-15579

Critical

Published: 18/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In PHPSUGAR PHP Melody before version 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.

An attacker could exploit this vulnerability to execute unauthorized database queries, potentially leading to data disclosure or modification.

It is recommended to upgrade to version 2.7.3 or later to mitigate this vulnerability.

Original NVD description (English source)

In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.