high7.5Public exploit code
CVE-2005-4527
Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via (1) the setLang parameter in index.php a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Direct News 4.9 - 'index.php' SQL Injection2005-12-19 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via (1) the setLang parameter in index.php and (2) unspecified search module parameters.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Direct News | Direct News | Version 4.9 |
References
- NVD record
- CVE.org record
- http://pridels0.blogspot.com/2005/12/direct-news-sql-inj.html
- http://www.osvdb.org/21854
- http://www.osvdb.org/22340
- http://www.securityfocus.com/bid/15957/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23727
- http://pridels0.blogspot.com/2005/12/direct-news-sql-inj.html
- http://www.osvdb.org/21854
- http://www.osvdb.org/22340
- http://www.securityfocus.com/bid/15957/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23727