Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-4611: Smoelenboek extension lets logged‑in users run database commands

CVE-2015-4611 · published 11 years ago

Summary

The Smoelenboek extension for TYPO3 (versions before 1.0.9) allows anyone who is signed in to send their own database queries. This could let an attacker view, change, or delete information stored by the website. Install the updated version 1.0.9 or later to close the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
smoelenboek_project	smoelenboek	<= 1.0.8 `cpe:2.3:a:smoelenboek_project:smoelenboek::::::typo3::*`

Original advisory text

SQL injection vulnerability in the Smoelenboek (ncgov_smoelenboek) extension before 1.0.9 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published16 Jun 2015

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2015-4611 · NVD

Track software like this

Free during beta