GitHub Advisoryadvisory · Packagist

GHSA-947m-vgqc-x6v4 Typo3 Backend History Module Vulnerable to SQL Injection

MEDIUM Published 2022-05-17 Modified 2024-01-12 Official page ↗
Aliases
CVE-2012-6144
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
Weaknesses
CWE-89
Reviewed
2024-01-12

Affected packages

• Packagist typo3/cms: >= 4.5.0, < 4.5.21 → fixed in 4.5.21 • Packagist typo3/cms: >= 4.6.0, < 4.6.14 → fixed in 4.6.14 • Packagist typo3/cms: >= 4.7.0, < 4.7.6 → fixed in 4.7.6

Description

SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability.

Related

Alias · CVE (1)

  • CVE-2012-6144 SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References