SQL injection vulnerability in news.php in DGNews 2.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter in a newslist action. NOTE: this issue can produce resultant cross-site scripting (XSS).
Name | Vendor | Start Version | End Version |
---|---|---|---|
Dgnews | Dian_gemilang | 2.1 | 2.1 |
Dgnews | Dian_gemilang | 1.5.1 | 1.5.1 |