CVE-2019-19850: TYPO3 SQL Injection in low-level Query Generator
Summary
CVE-2019-19850: TYPO3 SQL Injection in low-level Query Generator. Affects typo3/cms across 3 version ranges.
>= 8.0, < 8.7.30
>= 9.0, < 9.5.12
>= 10.0, < 10.2.2
Fixed in 8.7.30, 9.5.12 or 10.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications. The TYPO3 CMS package is vulnerable to a SQL injection vulnerability in the low-level Query Generator. This vulnerability allows an attacker to inject malicious SQL queries into the system, potentially leading to unauthorized access, data manipulation, or data leakage. The vulnerability affects TYPO3 versions before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Exploitation requires the presence of the system extension ext:lowlevel and a valid backend user with administrator privileges.
Vulnerability Detail
The vulnerability arises due to mishandling of user-submitted content in the QueryGenerator class. The class fails to properly escape user input, making it susceptible to SQL injection attacks. An attacker can exploit this vulnerability by crafting malicious input that includes SQL statements, which will be executed by the system. Successful exploitation can result in unauthorized access to the database, data manipulation, or data leakage. To exploit this vulnerability, the attacker needs to have ext:lowlevel installed and a valid backend user with administrator privileges.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0, < 8.7.308.7.30composer require typo3/cms:8.7.30 -
>= 9.0, < 9.5.129.5.12composer require typo3/cms:9.5.12 -
>= 10.0, < 10.2.210.2.2composer require typo3/cms:10.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or update to the latest version of TYPO3 as mentioned in the 'how_to_fix' section.
Conclusion
The SQL injection vulnerability in TYPO3's low-level Query Generator can have serious consequences, including unauthorized access, data manipulation, and data leakage. It is crucial to update TYPO3 to the latest version or apply the official patches to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications.
SQL injection is a web security vulnerability that allows an attacker to manipulate SQL queries executed by a web application. By injecting malicious SQL code, an attacker can bypass authentication, access unauthorized data, modify data, or even execute arbitrary commands.
You can use the Vulert Playground at Vulert Scanner to check if your TYPO3 installation is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any known vulnerabilities.
Yes, the ext:lowlevel system extension needs to be installed for the vulnerability to be exploitable. If you do not require this extension for your application, it is recommended to remove it.
The SQL injection vulnerability in TYPO3 can lead to unauthorized access to the database, data manipulation, or data leakage. An attacker can execute arbitrary SQL queries, potentially compromising the integrity and confidentiality of the application's data.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
