Contao SQL injection in the backend and listing module
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-16558US | critical9.8 | — | ||
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module. | ||||
02
references
External citations — patches, advisories, analysis.
- https://contao.org/de/changelog/versions/4.4.htmlWEB
- https://contao.org/en/news/contao-4_4_8.htmlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2017-16558.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2017-16558.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/listing-bundle/CVE-2017-16558.yamlWEB
- https://github.com/contao/contao/blob/4.4.57/CHANGELOG.md#448-2017-11-15WEB
- https://github.com/contao/contao/commit/501cb3cd34d61089b94e7ed78da53977bc71fc3eWEB
- https://github.com/contao/contao/commit/6b4a2711edf166c85cfd7a53fed6aea56d4f0544WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan