CVE-2017-17999

CRITICAL

RISE Ultimate Project Manager 1.9 - SQL Injection via Search Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-17999. PoCs published by Ahmad Mahfouz.

AI-analyzed exploit summary This exploit demonstrates a time-based SQL injection vulnerability in RISE Ultimate Project Manager 1.9. The payload uses a sleep function to confirm the vulnerability via delayed response.

Description

SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search parameter to index.php/knowledge_base/get_article_suggestion/.

Exploits (1)

exploitdb WORKING POC
by Ahmad Mahfouz · textwebappsphp
https://www.exploit-db.com/exploits/43591

This exploit demonstrates a time-based SQL injection vulnerability in RISE Ultimate Project Manager 1.9. The payload uses a sleep function to confirm the vulnerability via delayed response.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: RISE Ultimate Project Manager 1.9
No auth needed
Prerequisites: Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/145902/RISE-1.9-SQL-Injection.html
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43591/

Scores

CVSS v3 9.8
EPSS 0.0341
EPSS Percentile 87.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
fairsketch/rise_ultimate_project_manager 1.9
Published Jan 23, 2018
Tracked Since Feb 18, 2026