SQL Injection

georgringer/news is vulnerable to SQL Injection. A malicious user can send a POST request with the OrderByAllowed parameter or the DateField parameter and an orderBy parameter to inject and execute arbitrary SQL commands. This can only be done if the overrideDemand is set to one which is the...