Description
A second variant of the remote SQL injection vulnerability exists in Neat Weblog 0.2 through a different injection point in the articleId parameter handling. A separate code path also fails to sanitize the parameter before database queries.
Impact
Attackers can exploit this alternate injection point to extract database contents using different SQL injection techniques, bypassing any partial mitigations for the first vulnerability.
Solution
Use parameterized queries throughout the application. Apply comprehensive input validation to all database interactions.