CVE-2010-3604: SQL Injection Vulnerability in in2code/powermail Extension for TYPO3
Summary
CVE-2010-3604: powermail extension for TYPO3 vulnerable to SQL Injection. Affects in2code/powermail versions < 1.5.4. Fixed in 1.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The in2code/powermail extension is a widely used TYPO3 package that facilitates the creation and management of forms within TYPO3 websites. It allows users to easily build forms, manage submissions, and customize form behavior. However, versions 1.5.3 and earlier are vulnerable to a SQL injection flaw that can be exploited by attackers to manipulate database queries.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the powermail extension, allowing remote attackers to execute arbitrary SQL commands through unspecified vectors. This can lead to unauthorized access to sensitive data, data corruption, or even complete control over the database. The vulnerability is classified under CWE-89, which pertains to SQL injection issues.
How To Fix
Minimum fixed version
1.5.4
This is the first release that contains the fix.
composer require in2code/powermail:1.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider implementing input validation and sanitization measures to mitigate the risk of SQL injection. Ensure that user inputs are properly escaped before being used in SQL queries.
Conclusion
The SQL injection vulnerability in the in2code/powermail extension for TYPO3 poses significant risks to applications using affected versions. It is crucial to update to version 1.5.4 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for in2code/powermail →
FAQ
SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It can allow attackers to view data that they are not normally able to retrieve.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
Failing to address this vulnerability can lead to unauthorized access to sensitive data, data loss, or complete database compromise, which can severely impact your application and its users.
Using older versions of the powermail extension is not safe due to known vulnerabilities, including CVE-2010-3604. It is highly recommended to update to the latest version.
If you cannot update the package right away, implement input validation and sanitization to reduce the risk of SQL injection attacks until you can perform the update.
Related vulnerabilities
Recent vulnerabilities recorded for in2code/powermail.
