CVE-2006-0972

Fantastic News 2.1.1 - SQL Injection via News.php Page Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-0972. PoCs published by SAUDI.

AI-analyzed exploit summary The provided text describes an SQL injection vulnerability in Fantastic News 2.1.1, where the 'page' parameter in 'news.php' is vulnerable to SQLi via pipe character injection. No actual exploit code is present, only a description and example URL.

Description

SQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the category vector is already covered by CVE-2005-3846.

Exploits (1)

exploitdb WRITEUP VERIFIED
by SAUDI · textwebappsphp
https://www.exploit-db.com/exploits/27321

The provided text describes an SQL injection vulnerability in Fantastic News 2.1.1, where the 'page' parameter in 'news.php' is vulnerable to SQLi via pipe character injection. No actual exploit code is present, only a description and example URL.

Classification
Writeup 80%
Attack Type
Sqli
Complexity
Trivial
Reliability
Theoretical
Target: Fantastic News 2.1.1
No auth needed
Prerequisites: Access to the vulnerable 'news.php' endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/16842
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/24943
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/426195/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/501

Scores

EPSS 0.0131
EPSS Percentile 67.1%

Details

Status published
Products (1)
fscripts/fantastic_news 2.1.1
Published Mar 03, 2006
Tracked Since Feb 18, 2026