Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-15960: Article Directory Script 3.0 lets attackers run database commands

CVE-2017-15960 · published 9 years ago

Summary

The Article Directory Script version 3.0 does not properly check the "id" value in its author and category pages. This allows someone to send specially crafted requests that can change or view data in the website's database. Update to the latest patched version or apply input validation to the affected pages to protect your site.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
yourarticlesdirectory	article_directory_script	3.0 `cpe:2.3:a:yourarticlesdirectory:article_directory_script:3.0:::::::*`

Original advisory text

Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.

References

https://packetstormsecurity.com/files/144429/Article-Directory-Script-3.0-SQL-In... Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/43099/ Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

2% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published29 Oct 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-15960 · NVD

Track software like this

Free during beta