GitHub Advisoryadvisory · Packagist

GHSA-4465-r2hg-v4rj CiviCRM SQL injection vulnerability via Quick Search API

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2013-4662
Ecosystem
Packagist
Packages
civicrm/civicrm-core
Severity
Moderate
Weaknesses
CWE-89
Reviewed
2023-08-29

Affected packages

• Packagist civicrm/civicrm-core: >= 4.2.0, < 4.2.9 → fixed in 4.2.9 • Packagist civicrm/civicrm-core: >= 4.3.0, < 4.3.3 → fixed in 4.3.3

Description

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.

Related

Alias · CVE (1)

  • CVE-2013-4662 The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References