CVE-2014-5387

EllisLab ExpressionEngine Core is affected by multiple SQL injection vulnerabilities in versions prior to 2.9.1. An authenticated attacker can abuse vulnerable parameters (column_filter, category[] in system/index.php; tbl_sort[0][] in the comment module’s system/index.php) to execute arbitrary S...