CVE-2005-4527

Direct News 4.9 - SQL Injection

Title source: llm

Description

Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via (1) the setLang parameter in index.php and (2) unspecified search module parameters.

Exploits (1)

exploitdb WRITEUP VERIFIED

by r0t · textwebappsphp

https://www.exploit-db.com/exploits/26897

View Code ZIP pw:eip

References (5)

Core 5

Core References

Exploit vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/15957/

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/23727

Exploit vdb-entry x_refsource_osvdb

http://www.osvdb.org/21854

Third Party Advisory x_refsource_misc

http://pridels0.blogspot.com/2005/12/direct-news-sql-inj.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/22340

Scores

EPSS 0.0043

EPSS Percentile 63.0%

Details

Status published

Products (1)

direct_news/direct_news 4.9

Published Dec 28, 2005

Tracked Since Feb 18, 2026