GHSA-4h9j-f98m-p4hg

TYPO3 PHP remote file inclusion vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2010-1153

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	typo3/cms	>= 4.3.0, < 4.3.3	4.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2010-1153 advisory
https://github.com/TYPO3/typo3 package
https://web.archive.org/web/20100813082506/http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008 web
http://marc.info/?l=oss-security&m=127092306209177&w=2 web
http://www.openwall.com/lists/oss-security/2010/04/12/1 web