CVE-2014-6295: SQL Injection Vulnerability in WEC Map Extension for TYPO3
Summary
CVE-2014-6295: WEC Map (wec_map) extension for TYPO3 allows SQL Injection. Affects web-tp3/wec_map versions < 3.0.3. Fixed in 3.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The WEC Map extension for TYPO3 is a popular tool that allows users to integrate interactive maps into their TYPO3 websites. It provides features such as customizable map markers, various map types, and user-friendly interfaces for managing map data. However, prior to version 3.0.3, this extension was found to be vulnerable to SQL injection attacks, which could allow malicious users to manipulate the database through crafted SQL queries.
Vulnerability Detail
The SQL injection vulnerability in the WEC Map extension arises from improper handling of user input, allowing attackers to execute arbitrary SQL commands. This could lead to unauthorized access to sensitive data, data manipulation, or even complete database compromise. The vulnerability is particularly concerning as it can be exploited remotely, making it accessible to a wide range of potential attackers.
How To Fix
Minimum fixed version
3.0.3
This is the first release that contains the fix.
composer require web-tp3/wec_map:3.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization on user inputs that interact with the database. This can help mitigate the risk of SQL injection attacks until the extension can be updated.
Conclusion
The SQL injection vulnerability in the WEC Map extension for TYPO3 poses a significant risk to applications using this extension. It is crucial to update to version 3.0.3 or later to safeguard against potential attacks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your software effectively.
See every vulnerability recorded for web-tp3/wec_map →
FAQ
SQL injection is a code injection technique that exploits a vulnerability in an application's software by allowing an attacker to interfere with the queries that an application makes to its database.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your composer.lock file, Vulert can identify if your application is affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, data loss, or complete control over the database, which can severely impact the integrity and security of your application.
Implementing input validation and sanitization can help mitigate the risk of SQL injection attacks until you can update the extension to a secure version.
Detailed information about this vulnerability can be found on the GitHub advisory database and other security advisory platforms.
References
Related vulnerabilities
Recent vulnerabilities recorded for web-tp3/wec_map.
