CVE-2009-1505

SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute arbitrary SQL commands via the Include Words (aka keywords) field.

Score

CVSS 2.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2009-05-01

Last modified

2024-08-07

Weaknesses

CWE-89

Affected products

• News Page (Drupal)

References

• http://drupal.org/node/449014
• http://osvdb.org/54151
• http://secunia.com/advisories/34954
• http://www.securityfocus.com/bid/34777
• http://www.vupen.com/english/advisories/2009/1214
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50248