Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.4

TYPO3 SQL injection attack can run malicious database commands

CVE-2013-1842 · published 13 years ago
Summary

The TYPO3 web application has a security flaw that allows hackers to run their own SQL commands on the database. This could lead to unauthorized access to sensitive data or disruption of the website. Update to the latest version of TYPO3 to patch this vulnerability.

What to do
  • Update typo3 cms-core to version 4.5.24.
  • Update typo3 cms-core to version 4.6.17.
  • Update typo3 cms-core to version 4.7.9.
  • Update typo3 cms-core to version 6.0.3.
Affected software
Ecosystem VendorProductAffected versions
composer typo3 cms-core >= 4.5.0, <= 4.5.23
>= 4.6.0, < 4.6.17
>= 4.7.0, < 4.7.9
>= 6.0.0, < 6.0.3
Fix: upgrade to 4.5.24
– typo3 typo3 4.5
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.5.10
42 more version ranges
cpe:2.3:a:typo3:typo3:4.5:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL c...
SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
7.4 High
Exploitation
3% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published20 Mar 2013
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-m64j-j252-jxmr · GHSA
CVE-2013-1842 · NVD
Track software like this
Free during beta