CVE-2013-5322: SQL Injection Vulnerability in CoolURI Extension for TYPO3
Summary
CVE-2013-5322: CoolURI extension for TYPO3 vulnerable to SQL Injection. Affects bednee/cooluri versions < 1.0.30. Fixed in 1.0.30. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CoolURI extension for TYPO3 is designed to enhance the URL structure of TYPO3 websites, making them more user-friendly and SEO-friendly. It allows for cleaner URLs by rewriting them, which can improve site navigation and indexing by search engines. However, prior to version 1.0.30, the extension was found to be vulnerable to SQL injection attacks, which could compromise the integrity of the database and lead to unauthorized access to sensitive information.
Vulnerability Detail
The SQL injection vulnerability in the CoolURI extension allows remote attackers to execute arbitrary SQL commands through unspecified vectors. This flaw arises from improper handling of user input, which can be manipulated to alter SQL queries. The potential ramifications include unauthorized data access, data manipulation, and complete control over the database, posing a significant risk to the security of the affected TYPO3 installations.
How To Fix
Minimum fixed version
1.0.30
This is the first release that contains the fix.
composer require bednee/cooluri:1.0.30Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the CoolURI extension temporarily until a patch can be applied. This will mitigate the risk of exploitation while you work on a permanent solution.
Conclusion
The CoolURI extension for TYPO3 has a critical SQL injection vulnerability that can be exploited by attackers to execute arbitrary SQL commands. It is crucial to update to version 1.0.30 or later to mitigate this risk. Regular monitoring and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for bednee/cooluri →
FAQ
SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It can allow attackers to view data that they are not normally able to retrieve.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
Failing to fix this vulnerability can lead to unauthorized access to your database, data loss, or even complete control of your TYPO3 installation by malicious actors.
Yes, to prevent SQL injection, always validate and sanitize user inputs, use prepared statements, and employ ORM frameworks that abstract SQL queries.
If you cannot update the extension right away, consider disabling it temporarily to prevent exploitation until you can apply the necessary updates.
