vendor:
DGNews
by:
milw0rm.com
9
CVSS
HIGH
SQL Injection
89
CWE
Product Name: DGNews
Affected Version From: 3.0 Beta
Affected Version To: 3.0 Beta
Patch Exists: YES
Related CWE: CVE-2009-2118
CPE: a:diangemilang:dgnews:3.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2009
DGNews 3.0 Beta (berita.php) Remote SQL Injection Vulnerability
DGNews 3.0 Beta is prone to a remote SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this issue to manipulate SQL queries by injecting arbitrary SQL code. This may allow the attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
Mitigation:
Upgrade to the latest version of DGNews 3.0 Beta.
