CVE-2020-18215

Multiple SQL Injection vulnerabilities in PHPSHE 1.7 in phpshe/admin.php via the (1) ad_id, (2) menu_id, and (3) cashout_id parameters, which could let a remote malicious user execute arbitrary code.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.99% chance of exploitation in the next 30 days, 79th percentile

Published

2021-02-09

Updated

2024-08-04

Proof-of-concept exploits (2)

• https://gitee.com/koyshe/phpshe/issues/ITLK2
• lemon666/vuln/blob/master/Phpshe1.7_sql1.md

References

• CVE Record
• NVD entry

Related

• CVE-2017-12788
• CVE-2017-12789
• CVE-2017-12790
• CVE-2020-18198
• CVE-2020-18221
• CVE-2020-18195