GitHub Advisoryadvisory · Packagist

GHSA-gx4p-6w86-f8jx Typo3 SQL injection due to faulty prepared statements

CRITICAL Published 2022-04-22 Modified 2024-01-12 Official page ↗
Aliases
CVE-2011-3583
Ecosystem
Packagist
Packages
typo3/cms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-01-12

Affected packages

• Packagist typo3/cms: >= 4.5.0, <= 4.5.5 (no fix yet)

Description

It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input.

Related

Alias · CVE (1)

  • CVE-2011-3583 It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References