CVE-2017-17778: Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter

Routine

MEDIUM 4.8DOWNGRADE

CVE-2017-17778 is a medium-severity flaw (CVSS 4.8) affecting paid to read script. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter.

Why this priority

Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	4.8 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	High
User interaction	Required
EPSS exploit chance	0.5% (top 56%)
CISA exploited list	No
Weakness	CWE-79
Published	2017-12-20
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: paid to read script project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2017-12-20 03:29 UTCPublished CVE record published
2026-06-17 01:11 UTCUpdated Record last modified

paid to read script project paid to read script DOWNGRADE

Affected: 2.0.5

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.0.5

1. Check installed version

apt-cache policy paid-to-read-script || rpm -q paid-to-read-script || paid-to-read-script --version

2. No fixed release: DOWNGRADE to a release before 2.0.5 (Debian / Ubuntu)

apt-cache madison paid-to-read-script sudo apt install paid-to-read-script=<VERSION_BEFORE_2.0.5> sudo apt-mark hold paid-to-read-script

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list paid-to-read-script sudo dnf downgrade paid-to-read-script-<VERSION_BEFORE_2.0.5> sudo dnf versionlock add paid-to-read-script

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2017-17778?

paid to read script: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2017-17778 being exploited?

CVE-2017-17778 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2017-17778 affect?

CVE-2017-17778 affects paid to read script. Severity is medium (CVSS 4.8). Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter.

How urgent is CVE-2017-17778?

Priority 33/100. Public exploit reference

Software pages

PHP vulnerabilities

Related CVEs

CVE-2017-17779 CRITICAL 9.8 DOWNGRADE Paid To Read Script 2.0.5 has SQL injection via the referrals.php id parameter.
CVE-2017-17777 CRITICAL 9.8 DOWNGRADE Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated b
CVE-2017-17776 MEDIUM 5.3 DOWNGRADE Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter.
CVE-2017-17651 CRITICAL 9.8 DOWNGRADE Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php

References

← Back to latest CVEs