CVE-2017-7581

critical · 9.8

SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.

9.8

CVSS

48.4%

EPSS (exploit prob.)

99th

EPSS percentile

2017-04-07

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
news_system_project	news_system	<= 5.3.2

Check a specific version with /api/v1/cve/match.

References

https://www.ambionics.io/blog/typo3-news-module-sqli
https://www.ambionics.io/blog/typo3-news-module-sqli

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-7581