Description
Multiple vulnerabilities exist in EasyNews 4.0tr, including SQL injection, cross-site scripting (XSS), and local file inclusion (LFI). Various parameters lack proper input validation.
Impact
SQL injection allows database data extraction and modification. XSS enables session hijacking. LFI allows reading arbitrary server files. The combination provides multiple attack vectors for compromising the application.
Solution
Apply parameterized queries, output encoding, and file path validation. Consider migrating to a maintained news publishing system.