What is GHSA-4465-r2hg-v4rj?

GHSA-4465-r2hg-v4rj is a security advisory published by GitHub Security Advisories with Medium severity. CiviCRM SQL injection vulnerability via Quick Search API

Which CVE IDs does GHSA-4465-r2hg-v4rj cover?

GHSA-4465-r2hg-v4rj covers the following CVE IDs: CVE-2013-4662. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-4465-r2hg-v4rj?

GHSA-4465-r2hg-v4rj affects 2 products, including: composer/civicrm/civicrm-core:\u003e= 4.2.0, \u003c 4.2.9; composer/civicrm/civicrm-core:\u003e= 4.3.0, \u003c 4.3.3.

GHSA-4465-r2hg-v4rjMedium

CiviCRM SQL injection vulnerability via Quick Search API

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

August 29, 2023

🔗 CVE IDs covered (1)

CVE-2013-4662 →

📋 Description

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.

🎯 Affected products2

composer/civicrm/civicrm-core:>= 4.2.0, < 4.2.9
composer/civicrm/civicrm-core:>= 4.3.0, < 4.3.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2013-4662
https://civicrm.org/advisory/civi-sa-2013-004-limited-sql-injection-quick-search-api
https://issues.civicrm.org/jira/browse/CRM-12765
https://github.com/advisories/GHSA-4465-r2hg-v4rj