Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

TYPO3 sg_zfelib lets remote attackers run database commands

CVE-2008-2489 · published 18 years ago
Summary

The sg_zfelib extension for TYPO3 (versions up to 1.1.512) can be tricked into running unauthorized database statements when it receives crafted web input. This could let an attacker view, change, or delete your site’s data. Update the extension to the latest version or disable/remove it until a safe update is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
typo3 sg_zfelib <= 1.1.512
cpe:2.3:a:typo3:sg_zfelib:*:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in the Library for Frontend Plugins (aka sg_zfelib) extension 1.1.512 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified "us...
SQL injection vulnerability in the Library for Frontend Plugins (aka sg_zfelib) extension 1.1.512 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified "user input."
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published28 May 2008
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2008-2489 · NVD
Track software like this
Free during beta