CVE-2012-4383: Contao core SQL Injection Vulnerability
Summary
CVE-2012-4383: Contao core SQL Injection Vulnerability. Affects contao/core versions < 2.11.4. Fixed in 2.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao core is a package available on Packagist that provides a content management system (CMS) for building websites. It offers various features and modules for managing content, user authentication, and backend administration. The vulnerability in Contao core prior to version 2.11.4 allows for SQL injection attacks through the 'contao-2.11.3\system\modules\backend\Ajax.php' file.
Vulnerability Detail
The SQL injection vulnerability in Contao core allows an attacker to manipulate SQL queries and potentially gain unauthorized access to the database. This can lead to various security issues, such as data theft, modification, or deletion. The vulnerability originates from improper input sanitization in the 'Ajax.php' file, which allows malicious SQL code to be executed. The impact of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Minimum fixed version
2.11.4
This is the first release that contains the fix.
composer require contao/core:2.11.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to restrict access to the 'Ajax.php' file or disable the affected functionality if it is not essential for the application. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The SQL injection vulnerability in Contao core prior to version 2.11.4 poses a significant risk to the security of websites using this package. It is crucial to upgrade to the latest version or apply the provided workaround to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for contao/core →
FAQ
Contao core is a content management system (CMS) package used for building websites.
SQL injection is a type of vulnerability that allows an attacker to manipulate SQL queries to gain unauthorized access to a database.
The vulnerability can lead to unauthorized access, data theft, modification, or deletion.
You can fix this vulnerability by upgrading Contao core to version 2.11.4 or later.
Yes, you can restrict access to the 'Ajax.php' file or disable the affected functionality as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core.
