--- title: "TYPO3-EXT-SA-2017-001: SQL Injection in extension \"News system\" (news)" url: "https://news.typo3.com/security/advisory/typo3-ext-sa-2017-001" description: "It has been discovered that the extension \"News system\" (news) is susceptible to SQL Injection." image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - TYPO3 Extensions --- # TYPO3-EXT-SA-2017-001: SQL Injection in extension "News system" (news) - Security / [TYPO3 Extensions](https://news.typo3.com/article/category/security/typo3-extensions) TYPO3-EXT-SA-2017-001: SQL Injection in extension "News system" (news) ====================================================================== 10 April 2017 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that the extension "News system" (news) is susceptible to SQL Injection. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/60cadc25d9a14674c5c05025d6f818a4.jpeg)[Georg Ringer](https://news.typo3.com/article/author/georg-ringer) **Release Date:** April 10, 2017 **Component Type:** Third party extension. This extension is not a part of the TYPO3 default installation. **Affected Versions:** versions 3.2.6 and below, 4.0.0 to 4.3.0 and 5.0.0 to 5.3.2 **Vulnerability Type:** SQL Injection **Severity:** Critical **Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:P/A:N/E:F/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:P/A:N/E:F/RL:O/RC:C%29&g=2&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage")) **CVE:** not assigned yet **Problem Description:** The extension fails to properly sanitize user input and is susceptible to SQL Injection. **Solution:** The updated versions [3.2.7](https://typo3.org/extensions/repository/download/news/3.2.7/t3x/) and [5.3.3](https://typo3.org/extensions/repository/download/news/5.3.3/t3x/) are available from the TYPO3 Extension Manager and at [https://typo3.org/extensions/repository/view/news](https://typo3.org/extensions/repository/view/news "Opens external link in new window"). Users of the extension are advised to update the extension as soon as possible. The updated version [4.3.1](https://github.com/georgringer/news/releases/tag/4.3.1) will be available from version control or via [composer](https://packagist.org/packages/georgringer/news). **Credits**: Credits go to Ambionics Security who discovered and reported the vulnerability. **Note:** In case you extended the controller of the News extension in your own extensions, be sure to apply the fix there too. **General advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://docs.typo3.org/typo3cms/SecurityGuide/ "Initiates file download"). Please subscribe to the [typo3-announce mailing list](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce "Opens external link in new window") to receive future Security Bulletins via E-mail. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/99db18b2c6e92024e8936def3dc244e7.jpeg) About the Author [Georg Ringer](https://news.typo3.com/article/author/georg-ringer) TYPO3 developer,Linz, Austria [Website](http://montagmorgen.at/)[Twitter](https://twitter.com/georg_ringer)[LinkedIn](https://www.linkedin.com/in/georgringer/)[Xing](https://www.xing.com/profile/Georg_Ringer/cv) Georg Ringer has been part of the TYPO3 community more than 10 years and is known for the large number of extensions he has published. He is part of the TYPO3 Core and Security Teams and is also the GDPR Initiative Lead. [More posts by this author](https://news.typo3.com/article/author/georg-ringer)