https://www.exploit-db.com/exploits/23862
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200403-090

NewsManagerLite2.5版本存在多个SQL注入漏洞。远程攻击者借助（1）more.asp的ID参数，（2）category_news.asp的ID参数，或（3）news_sort.asp的filter参数执行任意SQL代码。

source: http://www.securityfocus.com/bid/9935/info
    
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
    
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
    
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/news_sort.asp?filter='[SQL]

来源:BID
名称:9935
链接:http://www.securityfocus.com/bid/9935
来源:SECTRACK
名称:1009507
链接:http://securitytracker.com/id?1009507
来源:XF
名称:news-manager-sql-injection(15549)
链接:http://xforce.iss.net/xforce/xfdb/15549
来源:OSVDB
名称:4497
链接:http://www.osvdb.org/4497
来源:OSVDB
名称:4496
链接:http://www.osvdb.org/4496
来源:OSVDB
名称:4495
链接:http://www.osvdb.org/4495
来源:SECUNIA
名称:11180
链接:http://secunia.com/advisories/11180
来源:BUGTRAQ
名称:20040322VulnerabilitiesinNewsManagerLite2.5&NewsManagerLiteadministration;
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=107999733503496&w;=2