Description
SQL injection vulnerability in the "Manage pages" feature (admin/pages) in Typo 5.1.3 and earlier allows remote authenticated users with "blog publisher" rights to execute arbitrary SQL commands via the search[published_at] parameter.
References
- 20081031 Typo <= 5.1.3 Multiple Vulnerabilities mailing-list
- 32272 third-party-advisory
- 31993 vdb-entry
- typo-searchpublishedat-sql-injection(46205) vdb-entry
- 4550 third-party-advisory