CVE-2012-1934

Newscoop - SQL Injection via f_country_code Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-1934. PoCs published by High-Tech Bridge SA.

AI-analyzed exploit summary This advisory details multiple vulnerabilities in Newscoop, including Remote File Inclusion (RFI), SQL Injection (SQLi), and Cross-Site Scripting (XSS). It provides Proof-of-Concept (PoC) URLs for each vulnerability but does not include executable exploit code.

Description

SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attackers to execute arbitrary SQL commands via the f_country_code parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by High-Tech Bridge SA · textwebappsphp

https://www.exploit-db.com/exploits/18752

View Code ZIP pw:eip

This advisory details multiple vulnerabilities in Newscoop, including Remote File Inclusion (RFI), SQL Injection (SQLi), and Cross-Site Scripting (XSS). It provides Proof-of-Concept (PoC) URLs for each vulnerability but does not include executable exploit code.

Classification

Writeup 100%

Attack Type

Rce | Sqli | Xss

Complexity

Trivial

Reliability

Reliable

Target: Newscoop 3.5.3 and prior, partially 4.0 RC3

Auth required

Prerequisites: register_globals enabled (for RFI) · magic_quotes_gpc disabled (for SQLi) · attacker must be logged in and have permission to manage countries (for SQLi)

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →