CVE-2013-5117

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in the RSS page (DNNArticleRSS.aspx) in the ZLDNN DNNArticle module before 10.1 for DotNetNuke allows remote attackers to execute arbitrary SQL commands via the categoryid parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/96306
http://seclists.org/fulldisclosure/2013/Sep/9
http://www.exploit-db.com/exploits/27602Exploit, Patch
http://www.securityfocus.com/bid/61788Exploit
http://www.zldnn.com/ViewArticle/Solution-for-DNNArticle-RSS-Security-Issue.aspxPatch, Vendor Advisory
http://osvdb.org/96306
http://seclists.org/fulldisclosure/2013/Sep/9
http://www.exploit-db.com/exploits/27602Exploit, Patch
http://www.securityfocus.com/bid/61788Exploit
http://www.zldnn.com/ViewArticle/Solution-for-DNNArticle-RSS-Security-Issue.aspxPatch, Vendor Advisory

Timeline

Published: Mar 12, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-51184.3Cross-site scripting (XSS) vulnerability in the Good for Enterprise app before 2.2.4.1659 for iOS allows remote attackers to inject arbitrar CVE-2013-51196.8Zimbra Collaboration Suite (ZCS) 6.0.16 and earlier allows man-in-the-middle attackers to obtain access by sniffing the network and replayin CVE-2013-51207.5SQL injection vulnerability in PHPFox before 3.6.0 (build4) allows remote attackers to execute arbitrary SQL commands via the search[gender]CVE-2013-51217.5SQL injection vulnerability in PHPFox before 3.6.0 (build6) allows remote attackers to execute arbitrary SQL commands via the search[sort_by CVE-2013-51229.8Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthenticated access CVE-2013-51235.9The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers CVE-2013-51256.8WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and CVE-2013-51266.8WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and CVE-2013-51276.8WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and CVE-2013-51286.8WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and CVE-2013-51294.3Multiple cross-site scripting (XSS) vulnerabilities in WebKit in Apple iOS before 7 allow user-assisted remote attackers to inject arbitrary CVE-2013-51305.0WebKit in Apple Safari before 6.1 disables the Private Browsing feature upon a launch of the Web Inspector, which makes it easier for contex