TYPO3 Sensitive Information Disclosure via escapeStrForLike method
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2010-5104US | medium4.3 | — | ||
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BA… | ||||
02
references
External citations — patches, advisories, analysis.
- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022WEB
- http://www.openwall.com/lists/oss-security/2011/01/13/2WEB
- http://www.openwall.com/lists/oss-security/2012/05/10/7WEB
- http://www.openwall.com/lists/oss-security/2012/05/11/3WEB
- http://www.openwall.com/lists/oss-security/2012/05/12/5WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64185WEB
- https://github.com/TYPO3-CMS/corePACKAGE
- https://github.com/TYPO3/typo3/commit/9eb4be4ccf10e6959699b9cce375d48697f06cbaWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan