itsourcecode News Portal Project 1.0 Category Editor SQL Injection Risk

Summary

A security flaw in itsourcecode News Portal Project 1.0 allows hackers to inject malicious SQL code through the category editor. This could potentially allow unauthorized access to sensitive data, so update the software to the latest version to protect your site and user data.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
clive_21	news_portal_project	1.0	–

Original title

A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-category.php. The manipulation of the arg...

Original description

A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-category.php. The manipulation of the argument Category results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/910biter/cve/issues/1 Exploit Issue Tracking Mitigation Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.347629 Permissions Required VDB Entry
https://vuldb.com/?id.347629 Third Party Advisory VDB Entry
https://vuldb.com/?submit.758324 Third Party Advisory VDB Entry