Vulnerability Description
PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpsugar | Php Melody | 3.0 |
Related Weaknesses (CWE)
References
- https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/Vendor Advisory
- https://www.phpsugar.com/phpmelody.htmlProduct
- https://www.vulncheck.com/advisories/php-melody-sql-injection-vulnerability-via-Third Party Advisory
- https://www.vulnerability-lab.com/get_content.php?id=2295ExploitThird Party Advisory
FAQ
What is CVE-2021-47915?
CVE-2021-47915 is a vulnerability with a CVSS score of 8.1 (HIGH). PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidate...
How severe is CVE-2021-47915?
CVE-2021-47915 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-47915?
Check the references section above for vendor advisories and patch information. Affected products include: Phpsugar Php Melody.