CVE-2010-0329: SQL Injection Vulnerability in in2code/powermail Extension
Summary
CVE-2010-0329: TYPO3 powermail Extension Vulnerable to SQL Injection via Unspecified Vectors. Affects in2code/powermail versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The in2code/powermail extension is a popular TYPO3 plugin that facilitates the creation and management of forms. It allows users to easily build forms with various fields and handle submissions efficiently. However, versions 1.5.1 and earlier are susceptible to a serious SQL injection vulnerability, which can compromise the integrity of the database and lead to unauthorized data access.
Vulnerability Detail
The SQL injection vulnerability in the powermail extension arises from improper handling of SQL queries related to the SQL selection field and typoscript. This flaw allows remote attackers to execute arbitrary SQL commands, potentially leading to data leakage, data manipulation, or complete database compromise. The vulnerability is classified under CWE-89, indicating its nature as a SQL injection issue, which is a common and severe security risk in web applications.
How To Fix
Minimum fixed version
1.5.2
This is the first release that contains the fix.
composer require in2code/powermail:1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the powermail extension or disable it until the update is applied. Additionally, ensure that your database user has limited permissions to mitigate potential damage from SQL injection attacks.
Conclusion
The SQL injection vulnerability in the in2code/powermail extension poses a significant risk to TYPO3 applications using versions 1.5.1 and earlier. It is crucial to update to version 1.5.2 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for in2code/powermail →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by inserting malicious SQL statements into an entry field for execution.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The risks include unauthorized access to sensitive data, data corruption, and potential complete control over the database by attackers.
Yes, to prevent SQL injection, always use prepared statements and parameterized queries, validate and sanitize user inputs, and employ web application firewalls.
If immediate updates are not possible, implement strict access controls and monitor database activity for any suspicious actions as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for in2code/powermail.
