| Package | Affected versions | Patched versions |
|---|---|---|
| georgringer/news | ≥ 11.0.0, < 11.4.4≥ 12.0.0, < 12.3.2≥ 13.0.0, < 13.0.2≥ 14.0.0, < 14.0.3< 10.0.4 | 11.4.412.3.213.0.214.0.310.0.4 |
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free