CVE-2009-1505 - SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute arbitrary SQL commands via the Include Words (aka keywords) field

Back Back to CVE browser

MEDIUM

SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute arbitrary SQL commands via the Include Words (aka keywords) field

Published May 1, 2009

6.5

MEDIUM

CVSS 2.0

EPSS 1.07%

Description

SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute arbitrary SQL commands via the Include Words (aka keywords) field.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (7)

http://drupal.org/node/449014
x_refsource_CONFIRMPatchVendor Advisory
http://osvdb.org/54151
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/34954
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/bid/34777
vdb-entryx_refsource_BIDPatch
http://www.vupen.com/english/advisories/2009/1214
vdb-entryx_refsource_VUPENVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-1502
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50248
vdb-entryx_refsource_XF

Link	Providers	Tags
http://drupal.org/node/449014		x_refsource_CONFIRMPatchVendor Advisory
http://osvdb.org/54151		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/34954		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/bid/34777		vdb-entryx_refsource_BIDPatch
http://www.vupen.com/english/advisories/2009/1214		vdb-entryx_refsource_VUPENVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-1502		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50248		vdb-entryx_refsource_XF