SQL Injection Vulnerability in TYPO3 Backend History Module
Summary
CVE-2012-6144: Typo3 Backend History Module Vulnerable to SQL Injection. Affects typo3/cms across 3 version ranges.
>= 4.5.0, < 4.5.21
>= 4.6.0, < 4.6.14
>= 4.7.0, < 4.7.6
Fixed in 4.5.21, 4.6.14 or 4.7.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications. The TYPO3 CMS includes a Backend History module that allows administrators to view and track changes made to the system. However, versions 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 are vulnerable to a SQL injection attack in the Backend History module. This vulnerability arises due to the lack of proper encoding of user input. Exploiting this vulnerability requires a valid backend login.
Vulnerability Detail
The SQL injection vulnerability in the TYPO3 Backend History module allows an attacker to manipulate SQL queries by injecting malicious code. This can lead to unauthorized access, data leakage, data manipulation, and even remote code execution. The lack of input encoding enables an attacker to craft malicious input that is executed as part of the SQL query. As a result, the attacker can bypass authentication, extract sensitive information, modify data, or execute arbitrary SQL commands.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.5.0, < 4.5.214.5.21composer require typo3/cms:4.5.21 -
>= 4.6.0, < 4.6.144.6.14composer require typo3/cms:4.6.14 -
>= 4.7.0, < 4.7.64.7.6composer require typo3/cms:4.7.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, TYPO3 administrators can disable or restrict access to the Backend History module for untrusted users. This can be done by modifying the access permissions or disabling the module entirely. However, this is not a permanent solution and upgrading to the latest patched version is strongly recommended.
Conclusion
The SQL injection vulnerability in the TYPO3 Backend History module can have serious security implications. It is crucial for TYPO3 users to upgrade to the latest patched version of the CMS to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications.
The Backend History module in TYPO3 allows administrators to view and track changes made to the system. It provides a log of actions performed by users in the backend.
The SQL injection vulnerability in the Backend History module occurs due to the lack of proper encoding of user input. This allows an attacker to inject malicious SQL code and manipulate the SQL queries executed by the module.
The potential consequences of this vulnerability include unauthorized access to sensitive information, data leakage, data manipulation, and even remote code execution. An attacker can exploit this vulnerability to bypass authentication, extract sensitive data, modify data, or execute arbitrary SQL commands.
To fix this vulnerability, TYPO3 users should upgrade to the latest patched version of the CMS. Upgrading to version 4.5.21 or later (for TYPO3 4.5.x), version 4.6.14 or later (for TYPO3 4.6.x), or version 4.7.6 or later (for TYPO3 4.7.x) is recommended.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
