GitHub Advisoryadvisory · Packagist

GHSA-vq59-x6mq-4wgw Contao SQL injection in the file manager

CRITICAL Published 2022-05-24 Modified 2024-04-25 Official page ↗
Aliases
CVE-2019-11512
Ecosystem
Packagist
Packages
contao/contao, contao/core-bundle
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-04-25

Affected packages

• Packagist contao/contao: >= 4.1.0, < 4.4.39 → fixed in 4.4.39 • Packagist contao/contao: >= 4.5.0, < 4.7.5 → fixed in 4.7.5 • Packagist contao/core-bundle: >= 4.1.0, < 4.4.39 → fixed in 4.4.39 • Packagist contao/core-bundle: >= 4.5.0, < 4.7.5 → fixed in 4.7.5

Description

David Wind, penetration tester with A1 Digital, has discovered that the SQL injection vulnerability originally published under CVE-2017-16558 can still be exploited in the file manager in Contao 4.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References