A vulnerability was found in stevejagodzinski DevNewsAggregator (affected version unknown). It has been rated as critical. Affected by this issue is the function getByName of the file php/data_access/RemoteHtmlContentDataAccess.php. The manipulation of the argument name with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability.

The weakness was shared 01/05/2023 as b9de907e7a8c9ca9d75295da675e58c5bf06b172. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2014-125040. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

By approaching the search of inurl:php/data_access/RemoteHtmlContentDataAccess.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch b9de907e7a8c9ca9d75295da675e58c5bf06b172 is able to eliminate this problem. The bugfix is ready for download at github.com. The advisory contains the following remark:

Fix SQL injection vulnerability

Productinfo

Vendor

• stevejagodzinski

Name

• DevNewsAggregator

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion