itsourcecode News Portal Project 1.0 - Unsecured Contact Form Can Be Hacked

Summary

The contact form on the itsourcecode News Portal Project 1.0 is not secure, allowing an attacker to manipulate data and potentially gain unauthorized access to the system. This means that sensitive information could be stolen or altered. To fix this, update to the latest version of the software or patch the affected file /admin/contactus.php to prevent exploitation.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
clive_21	news_portal_project	1.0	–

Original title

A vulnerability was found in itsourcecode News Portal Project 1.0. This issue affects some unknown processing of the file /admin/contactus.php. The manipulation of the argument pagetitle results in...

Original description

A vulnerability was found in itsourcecode News Portal Project 1.0. This issue affects some unknown processing of the file /admin/contactus.php. The manipulation of the argument pagetitle results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/a936848435/cve-report-cyy/issues/1 Exploit Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.347671 Permissions Required VDB Entry
https://vuldb.com/?id.347671 Third Party Advisory VDB Entry
https://vuldb.com/?submit.759546 Third Party Advisory VDB Entry