The TYPO3 extension "News system" contains an SQL injection vulnerability (CWE-89) due to failure to properly sanitize user input before incorporating it into database queries. Specifically, the issue exists in the "Date Menu of news articles" plugin, where an unauthenticated attacker can inject SQL commands through a crafted URL parameter. Successful exploitation depends on the plugin being active and the TypoScript/Plugin setting disableOverrideDemand being disabled. The vulnerability has a CVSS 4.0 base score of 8.2, indicating high severity. No official patch or remediation level has been disclosed by the vendor as of the publication date.

An attacker can execute arbitrary SQL commands on the backend database without authentication, potentially leading to unauthorized data access or manipulation. The impact is high due to the ability to inject SQL and the lack of required privileges or user interaction. However, exploitation is conditional on specific plugin usage and configuration settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the "Date Menu of news articles" plugin or enabling the TypoScript/Plugin setting disableOverrideDemand to mitigate the risk. Monitor vendor communications for updates on patches or official mitigations.