9.8crit
CVE-2017-7581in critical feed1 exploit
SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute ar…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
48.4%
percentile 99%
Public exploits
1
Metasploit
Summary
SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.
Exploit prediction (EPSS)
48.43% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- Metasploit auxiliary/admin/http/typo3_news_module_sqli TYPO3 News Module SQL Injection · metasploit auxiliary, normal rank · 2017-04-06
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- ambionics.io /blog/typo3-news-module-sqli · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-7581
- NVD: CVE-2017-7581
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.