SQL Injection in Mocdesigns PHP News

CVE-2009-2921

Multiple SQL injection vulnerabilities in login.php in MOC Designs PHP News 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) newsuser parameter (User field) and (2) newspassword parameter (Password field).

Vulnerability class: SQL Injection

EPSS: 0.012 (63.7th percentile) — read the EPSS interpretation.

Affected products

Mocdesigns Php_news — versions 1.1
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
cve@mitre.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)