VULNERABILITY INTELLIGENCE

CVE-2017-7581

CVSS score9.8 CRITICAL

EPSS probability48.43%

CISA KEVNot currently listed

Published2017-04-07

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.

Weakness classification

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references

cve@mitre.org — Exploit, Patch, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Technical Description, Third Party Advisory