GHSA-gx4p-6w86-f8jxCriticalCVSS 9.8

Typo3 SQL injection due to faulty prepared statements

Published
April 22, 2022
Last Modified
January 12, 2024

🔗 CVE IDs covered (1)

CVE-2011-3583 →

📋 Description

It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input.

🎯 Affected products1

  • composer/typo3/cms:>= 4.5.0, <= 4.5.5

🔗 References (6)