CVE-2013-1842
SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."
| Software | From | Fixed in |
|---|---|---|
| typo3 / typo3 | 4.5.3 | 4.5.3.x |
| typo3 / typo3 | 4.5.9 | 4.5.9.x |
| typo3 / typo3 | 4.5.12 | 4.5.12.x |
| typo3 / typo3 | 4.5.15 | 4.5.15.x |
| typo3 / typo3 | 4.5.5 | 4.5.5.x |
| typo3 / typo3 | 4.5.13 | 4.5.13.x |
| typo3 / typo3 | 4.5.17 | 4.5.17.x |
| typo3 / typo3 | 4.5.8 | 4.5.8.x |
| typo3 / typo3 | 4.5.14 | 4.5.14.x |
| typo3 / typo3 | 4.5.23 | 4.5.23.x |
| typo3 / typo3 | 4.5.7 | 4.5.7.x |
| typo3 / typo3 | 4.5.6 | 4.5.6.x |
| typo3 / typo3 | 4.5.18 | 4.5.18.x |
| typo3 / typo3 | 4.5.0 | 4.5.0.x |
| typo3 / typo3 | 4.5 | 4.5.x |
| typo3 / typo3 | 4.5.11 | 4.5.11.x |
| typo3 / typo3 | 4.5.19 | 4.5.19.x |
| typo3 / typo3 | 4.5.1 | 4.5.1.x |
| typo3 / typo3 | 4.5.16 | 4.5.16.x |
| typo3 / typo3 | 4.5.4 | 4.5.4.x |
| typo3 / typo3 | 4.5.22 | 4.5.22.x |
| typo3 / typo3 | 4.5.2 | 4.5.2.x |
| typo3 / typo3 | 4.5.10 | 4.5.10.x |
| typo3 / typo3 | 4.6.16 | 4.6.16.x |
| typo3 / typo3 | 4.6.6 | 4.6.6.x |
| typo3 / typo3 | 4.6.3 | 4.6.3.x |
| typo3 / typo3 | 4.6.13 | 4.6.13.x |
| typo3 / typo3 | 4.6.12 | 4.6.12.x |
| typo3 / typo3 | 4.6.8 | 4.6.8.x |
| typo3 / typo3 | 4.6.0 | 4.6.0.x |
| typo3 / typo3 | 4.6.10 | 4.6.10.x |
| typo3 / typo3 | 4.6.5 | 4.6.5.x |
| typo3 / typo3 | 4.6.15 | 4.6.15.x |
| typo3 / typo3 | 4.6 | 4.6.x |
| typo3 / typo3 | 4.6.1 | 4.6.1.x |
| typo3 / typo3 | 4.6.4 | 4.6.4.x |
| typo3 / typo3 | 4.6.7 | 4.6.7.x |
| typo3 / typo3 | 4.6.2 | 4.6.2.x |
| typo3 / typo3 | 4.6.9 | 4.6.9.x |
| typo3 / typo3 | 4.6.14 | 4.6.14.x |
| typo3 / typo3 | 4.6.11 | 4.6.11.x |
| typo3 / typo3 | 4.7.5 | 4.7.5.x |
| typo3 / typo3 | 4.7.8 | 4.7.8.x |
| typo3 / typo3 | 4.7.1 | 4.7.1.x |
| typo3 / typo3 | 4.7.2 | 4.7.2.x |
| typo3 / typo3 | 4.7.4 | 4.7.4.x |
| typo3 / typo3 | 4.7.7 | 4.7.7.x |
| typo3 / typo3 | 4.7.6 | 4.7.6.x |
| typo3 / typo3 | 4.7 | 4.7.x |
| typo3 / typo3 | 4.7.0 | 4.7.0.x |
| typo3 / typo3 | 4.7.3 | 4.7.3.x |
| typo3 / typo3 | 6.0.1 | 6.0.1.x |
| typo3 / typo3 | 6.0.2 | 6.0.2.x |
| typo3 / typo3 | 6.0 | 6.0.x |
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00079.html
- http://osvdb.org/90925
- http://secunia.com/advisories/52433
- http://secunia.com/advisories/52638
- http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/sql-injection-and-open-redirection-in-typo3-core/
- http://www.debian.org/security/2013/dsa-2646
- http://www.openwall.com/lists/oss-security/2013/03/12/3
- http://www.securityfocus.com/bid/58330
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime