GHSA-mgw4-gv3f-g57j

TYPO3 powermail Extension Vulnerable to SQL Injection via Unspecified Vectors

Source: GitHub Advisory Database (reviewed) High CVE-2010-0329

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	in2code/powermail	< 1.5.2	1.5.2

Details

As written in the advisory (Markdown source, shown as plain text).

SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the "SQL selection field" and "typoscript."

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2010-0329 advisory
https://web.archive.org/web/20100123124044/http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021 web
http://typo3.org/extensions/repository/view/powermail/1.5.2 web
http://typo3.org/extensions/repository/view/powermail/1.5.2/info/changelog.txt web