Description
SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute arbitrary SQL commands via the Include Words (aka keywords) field.
References
- 34777 vdb-entry
- 34954 third-party-advisory
- ADV-2009-1214 vdb-entry
- 54151 vdb-entry
- http://drupal.org/node/449014
- newspage-keywords-sql-injection(50248) vdb-entry