CVE-2019-11512: Contao SQL injection in the file manager
Summary
CVE-2019-11512: Contao SQL injection in the file manager. Affects contao/contao across 2 version ranges.
>= 4.1.0, < 4.4.39
>= 4.5.0, < 4.7.5
Fixed in 4.4.39 or 4.7.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that allows users to create and manage websites. The file manager in Contao 4 is responsible for handling file uploads and managing files within the CMS. This component is vulnerable to a SQL injection attack, which can allow an attacker to execute arbitrary SQL queries and potentially gain unauthorized access to the database.
Vulnerability Detail
The SQL injection vulnerability in the file manager of Contao 4, originally published under CVE-2017-16558, is still exploitable. This vulnerability can be leveraged by an attacker to inject malicious SQL queries into the application, leading to unauthorized access, data manipulation, or even remote code execution. The impact of this vulnerability is critical, as it can compromise the confidentiality, integrity, and availability of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.1.0, < 4.4.394.4.39composer require contao/contao:4.4.39 -
>= 4.5.0, < 4.7.54.7.5composer require contao/contao:4.7.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to restrict access to the file manager component or disable it if not required. Additionally, input validation and parameterized queries can be implemented to mitigate the risk of SQL injection attacks. Here is an example of how parameterized queries can be used in PHP:
$statement = $pdo->prepare('SELECT * FROM users WHERE username = :username');
$statement->bindParam(':username', $username);
$statement->execute();
$result = $statement->fetchAll();
Conclusion
The SQL injection vulnerability in the file manager of Contao 4 can have severe consequences for the security of the affected system. It is crucial to apply the recommended fixes by upgrading Contao and the core-bundle package to the specified versions. Regularly updating the CMS and its components is essential to ensure the latest security patches are in place. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for contao/contao →
FAQ
Contao is an open-source content management system (CMS) used for creating and managing websites.
The file manager in Contao is a component responsible for handling file uploads and managing files within the CMS.
SQL injection is a type of vulnerability that allows an attacker to manipulate SQL queries executed by an application, potentially leading to unauthorized access or data manipulation.
The impact of this vulnerability is critical, as it can compromise the confidentiality, integrity, and availability of the affected system.
To mitigate the risk of SQL injection attacks, it is important to implement input validation, sanitize user input, and use parameterized queries or prepared statements.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/contao.
