vendor:
TYPO3 CMS
by:
CyberNaj, JxE-13
7,5
CVSS
HIGH
SQL injection
89
CWE
Product Name: TYPO3 CMS
Affected Version From: 4.0
Affected Version To: 4.0
Patch Exists: NO
Related CWE: N/A
CPE: a:typo3:typo3_cms
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
TYPO3 CMS 4.0 SQL-Injection Vulnerability
A SQL injection vulnerability exists in TYPO3 CMS 4.0. An attacker can send a specially crafted HTTP request containing malicious SQL statements to the vulnerable application and execute arbitrary SQL commands in application's database. This can allow the attacker to access or modify critical application data, compromise the application, access or modify data in the backend database, and exploit various other attacks.
Mitigation:
Developers should never construct SQL statements directly from user input. Instead, parameterized statements should be used to avoid SQL injection attacks. Additionally, input validation should be used to detect malicious input early and prevent it from entering the system.
