Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Random Prayer extension lets attackers run database commands

CVE-2008-6694 · published 17 years ago
Summary

The Random Prayer (ste_prayer) add‑on for TYPO3 can be tricked into executing arbitrary database queries, which could expose or change your site’s data. This risk arises from insufficient input validation in the extension’s code. Apply any available updates from the vendor or disable/remove the extension until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
fr.simon_rundell ste_prayer 0.0.1
cpe:2.3:a:fr.simon_rundell:ste_prayer:0.0.1:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in Random Prayer (ste_prayer) 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
SQL injection vulnerability in Random Prayer (ste_prayer) 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published10 Apr 2009
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-6694 · NVD
Track software like this
Free during beta