GHSA-rg6g-v4xm-g49q

News system (news) extension for TYPO3 vulnerable to SQL Injection

Source: GitHub Advisory Database (reviewed) High CVE-2013-4748

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	georgringer/news	< 1.3.3	1.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

SQL injection vulnerability in the News system (news) extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-4748 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/81192 web
https://github.com/georgringer/news package
https://web.archive.org/web/20130214093535/http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-001 web
http://typo3.org/extensions/repository/view/news web