CVE-2017-7581 SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand fo...
CriticalCVSS 9.8
EPSS 48.4%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| news system project news system | <= 5.3.2 | No fix listed |
References
- www.ambionics.io exploit patch technical-description third-party-advisory