PT-2023-10110 · Stevejagodzinski · Devnewsaggregator
CVE-2014-125040
·
Publicado
2023-01-05
·
Atualizado
2024-05-17
CVSS v2.0
5.2
Média
| Vetor | AV:A/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
stevejagodzinski DevNewsAggregator (affected versions not specified)
Description
A critical issue was found in the function
getByName of the file php/data access/RemoteHtmlContentDataAccess.php. The manipulation of the argument name leads to sql injection.Recommendations
Apply a patch to fix this issue. The patch is identified by the name
b9de907e7a8c9ca9d75295da675e58c5bf06b172. As a temporary workaround, consider disabling the getByName function until a patch is available.Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Devnewsaggregator