PHPNews SQL Injection Vulnerability

Bugtraq ID:	11748
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 24 2004 12:00AM
Updated:	Nov 24 2004 12:00AM
Credit:	This vulnerability was reported to the vendor by AccessX.
Vulnerable:	PHPNews PHPNews 1.2.3
Not Vulnerable:	PHPNews PHPNews 1.2.4

PHPNews SQL Injection Vulnerability

It is reported that PHPNews is susceptible to an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input prior to utilizing it in an SQL query.

An attacker can exploit this issue to manipulate and inject SQL queries into the underlying database. It may be possible to leverage this issue to steal database contents including user credentials as well as to attack the underlying database.

Version 1.2.3 is reported susceptible to this vulnerability. Other versions may also be affected.

PHPNews SQL Injection Vulnerability

An exploit is not required.

PHPNews SQL Injection Vulnerability

Solution:
The vendor has released version 1.2.4 of the package to resolve this issue:


PHPNews PHPNews 1.2.3

• PHPNews phpnews_1-2-4.zip
  http://prdownloads.sourceforge.net/newsphp/phpnews_1-2-4.zip?download

PHPNews SQL Injection Vulnerability

References:

• Known Bugs [Plus Fixes] (PHPNews)
  
• PHPNews 1.2.3 => PHPNews 1.2.4 Changelog (PHPNews)
  
• PHPNews Home Page (PHPNews)