GHSA-947m-vgqc-x6v4

ghsaUSosv

Typo3 Backend History Module Vulnerable to SQL Injection

view advisory published 2022-05-17Licence: CC-BY-4.0

SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2012-6144US	medium6.5	2.17% (82nd)	—	2013-07-01
SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to exe…

references

External citations — patches, advisories, analysis.

http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005WEB
http://www.openwall.com/lists/oss-security/2013/06/19/4WEB
https://exchange.xforce.ibmcloud.com/vulnerabilities/79964WEB
https://nvd.nist.gov/vuln/detail/CVE-2012-6144ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan