| VID |
21658 |
| Severity |
30 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
CGI |
| Detailed Description |
The PHPNews software is vulnerable to an SQL injection vulnerability in the "news.php" script. PHPNews is an open source news content manager written in PHP. PHPNews version 1.2.5 and possibly earlier versions could allow a remote attacker to execute arbitrary SQL commands, caused by improper filtering of user-supplied input passed to the "prevnext" parameter of the "news.php" script. This vulnerability could permit a remote attacker to pass malicious input to database queries, potentially resulting in data exposure, modification of the query logic, or even data modification or attacks against the database itself.
* References:
http://sourceforge.net/project/shownotes.php?group_id=66322&release_id=339317
* Platforms Affected:
SourceForge.net, PHPNews version 1.2.5 and earlier versions
Any operating system Any version |
| Recommendation |
Upgrade to the latest version of PHPNews (1.2.6 or later), available from the SourceForge.net Web Download page at http://newsphp.sourceforge.net/downloads.php |
| Related URL |
CVE-2005-2156 (CVE) |
| Related URL |
14133 (SecurityFocus) |
| Related URL |
(ISS) |
|
