SQL Injection Vulnerability in Powie pNews Product
CVE-2008-2673
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2008-2673?
The vulnerability in Powie pNews versions 2.08 and 2.10 allows for SQL injection through unsanitized input in the index.php file. When magic_quotes_gpc is disabled, attackers can exploit the 'shownews' parameter to execute arbitrary SQL commands, leading to potential unauthorized data access or manipulation. This flaw highlights the importance of input validation and sanitation in web applications.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.