Softnews Media Group
Monthly
SQL injection in DataLife Engine 18.0 allows remote, unauthenticated attackers to manipulate the 'story' parameter in the Search Module's strip_data function, potentially leading to partial data disclosure or modification. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor-released patch is identified at time of analysis. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reachability without privileges or user interaction, though impact is limited to low confidentiality and integrity loss per the assessed CVSS 3.1 vector.
SQL injection in DataLife Engine 18.0 allows remote, unauthenticated attackers to manipulate the 'story' parameter in the Search Module's strip_data function, potentially leading to partial data disclosure or modification. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor-released patch is identified at time of analysis. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reachability without privileges or user interaction, though impact is limited to low confidentiality and integrity loss per the assessed CVSS 3.1 vector.