GHSA-59pj-7mjh-4465
TYPO3 SQL Injection in low-level Query Generator
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | typo3/cms | >= 8.0, < 8.7.30 | 8.7.30 |
| Packagist | typo3/cms | >= 9.0, < 9.5.12 | 9.5.12 |
| Packagist | typo3/cms | >= 10.0, < 10.2.2 | 10.2.2 |
| Packagist | typo3/cms-core | >= 8.0, < 8.7.30 | 8.7.30 |
| Packagist | typo3/cms-core | >= 9.0, < 9.5.12 | 9.5.12 |
| Packagist | typo3/cms-core | >= 10.0, < 10.2.2 | 10.2.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
References
External links from the advisory. They lead to third-party sites.