CVE-2016-15031 is a critical SQL injection vulnerability in PHP-Login version 1.0, specifically within the checkLogin function of the login/scripts/class.loginscript.php file, affecting the POST Parameter Handler. This flaw allows remote attackers to manipulate the 'myusername' argument, leading to a complete compromise of confidentiality, integrity, and availability. With a CVSS score of 9.8 (Critical), it is easily exploitable over the network with low attack complexity and no user interaction required. While no public exploit code (Metasploit, Nuclei, ExploitDB) or active exploitation has been observed, and community discussion is minimal, upgrading to PHP-Login version 2.0 or applying patch 0083ec652786ddbb81335ea20da590df40035679 is strongly recommended to mitigate this high-risk vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0CPE matchmatch criteria | cpe:2.3:a:php-login_project:php-login:1.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.