Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2017-17651: Paid To Read Script lets attackers manipulate database
CVE-2017-17651 · published 8 years ago
Summary
The Paid To Read Script version 2.0.5 accepts input on several admin pages that is not properly checked, allowing a malicious user to insert their own database commands. This can let an attacker view, change, or delete information stored by the application. Apply the vendor's security update or add proper input validation to the affected pages as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| paid_to_read_script_project | paid_to_read_script |
2.0.5 cpe:2.3:a:paid_to_read_script_project:paid_to_read_script:2.0.5:*:*:*:*:*:*:* |
Original advisory text
Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter.
Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter.
References
- https://packetstormsecurity.com/files/145439/Paid-To-Read-Script-2.0.5-SQL-Injec... Exploit Third Party Advisory VDB Entry
- https://www.exploit-db.com/exploits/43334/ Exploit Third Party Advisory VDB Entry
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published18 Dec 2017
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-17651 · NVD
Track software like this
Free during beta