News system (news) Extension for TYPO3 SQL Injection Vulnerability

Release date:
Updated on: 2013-07-04

Affected Systems:
TYPO3 news 1.3.2
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2013-4748

News system is a general News Extension Based on extbase & fluid.

News system (news) Extension for TYPO3 has a security vulnerability that allows remote attackers to execute SQL injection attacks. This vulnerability occurs because the program does not properly filter user input.

<* Source: Alex Kellner

Link: http://osvdb.org/89134
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

TYPO3
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://typo3.org/extensions/repository/view/news