Vulnerability advisory
GHSA-gx4p-6w86-f8jx
Typo3 SQL injection due to faulty prepared statements
Also known as CVE-2011-3583
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected versions
typo3/cms Packagist
All typo3/cms advisories →| Affected | Fixed in |
|---|---|
4.5.0 through 4.5.5 | No fix listed |
Description
It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input.