Contao SQL injection in the backend and listing module
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-16558US | critical9.8 | — | ||
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://contao.org/de/changelog/versions/4.4.htmlWEB
- https://contao.org/en/news/contao-4_4_8.htmlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2017-16558.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2017-16558.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/listing-bundle/CVE-2017-16558.yamlWEB
- https://github.com/contao/contao/blob/4.4.57/CHANGELOG.md#448-2017-11-15WEB
- https://github.com/contao/contao/commit/501cb3cd34d61089b94e7ed78da53977bc71fc3eWEB
- https://github.com/contao/contao/commit/6b4a2711edf166c85cfd7a53fed6aea56d4f0544WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan