GitHub Advisoryadvisory · Packagist
GHSA-v3mr-gp7j-pw5w Possible SQL injection in tablelookupwizard Contao Extension
CRITICAL
Official page ↗
- Ecosystem
- Packagist
- Packages
- terminal42/contao-tablelookupwizard
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
- Reviewed
- 2022-02-04
Affected packages
• Packagist terminal42/contao-tablelookupwizard: < 3.3.5 → fixed in 3.3.5
Description
Impact
The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.
Patches
The issue has been patched in `tablelookupwizard` version 3.3.5 and version 4.0.0.
For more information
If you have any questions or comments about this advisory:
• Open an issue in https://github.com/terminal42/contao-tablelookupwizard
• Email us at [email protected]
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://github.com/terminal42/contao-tablelookupwizard/security/advisories/GHSA-v3mr-gp7j-pw5w web
- https://github.com/terminal42/contao-tablelookupwizard/commit/a5e723a28f110b7df8ffc4175cef9b061d3cc717 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/terminal42/contao-tablelookupwizard/2022-02-04-1.yaml web
- https://github.com/terminal42/contao-tablelookupwizard package