GitHub Advisoryadvisory · Packagist

GHSA-9895-53fc-98v2 TYPO3 SQL Injection in dbal

HIGH Published 2024-06-03 Modified 2024-06-03 Official page ↗
Ecosystem
Packagist
Packages
typo3/cms
Severity
High
Reviewed
2024-06-03

Affected packages

• Packagist typo3/cms: >= 6.2.0, < 6.2.18 → fixed in 6.2.18

Description

A flaw in the database escaping API results in a SQL injection vulnerability when extension dbal is enabled and configured for MySQL passthrough mode in its extension configuration. All queries which use the DatabaseConnection::sql_query are vulnerable, even if arguments were properly escaped with DatabaseConnection::quoteStr beforehand.

References