CVE-2004-2474

Description

SQL injection vulnerability in PHPNews 1.2.3 allows remote attackers to execute arbitrary SQL commands via the mid parameter to sendtofriend.php.

Affected Platforms

Weakness Type

NVD-CWE-Other

References

• http://newsphp.sourceforge.net/changelog/changelog_1.24.txt
• http://secunia.com/advisories/13300
• http://www.osvdb.org/12119
• http://www.securityfocus.com/bid/11748
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18233
• http://newsphp.sourceforge.net/changelog/changelog_1.24.txt