{"api_version":"1","generated_at":"2026-07-23T08:09:18+00:00","cve":"CVE-2014-7201","urls":{"html":"https://cve.report/CVE-2014-7201","api":"https://cve.report/api/cve/CVE-2014-7201.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-7201","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-7201"},"summary":{"title":"CVE-2014-7201","description":"Multiple SQL injection vulnerabilities in the search function in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the (1) education, (2) region, or (3) sector fields, as demonstrated by the tx_dmmjobcontrol_pi1[search][sector][] parameter to jobs/.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-10-10 14:55:09","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://packetstormsecurity.com/files/128446/Typo3-JobControl-2.14.0-Cross-Site-Scripting-SQL-Injection.html","name":"http://packetstormsecurity.com/files/128446/Typo3-JobControl-2.14.0-Cross-Site-Scripting-SQL-Injection.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Typo3 JobControl 2.14.0 Cross Site Scripting / SQL Injection ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2014/Sep/89","name":"http://seclists.org/fulldisclosure/2014/Sep/89","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Full Disclosure: MSA-2014-02: Typo3 Extension dmmjobcontrol Multiple Vulnerabilities (typo3-ext-sa-2014-012)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-012","name":"http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-012","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Several vulnerabilities in extension JobControl (dmmjobcontrol) -  - TYPO3 - The Enterprise Open Source CMS","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.mogwaisecurity.de/advisories/MSA-2014-02.txt","name":"https://www.mogwaisecurity.de/advisories/MSA-2014-02.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://www.securityfocus.com/bid/70155","name":"http://www.securityfocus.com/bid/70155","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"TYPO3 JobControl SQL Injection and Cross Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7201","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7201","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"7201","vulnerable":"1","versionEndIncluding":"2.14.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kevin_renskers","cpe5":"dmmjobcontrol","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"typo3","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T12:40:19.058Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/128446/Typo3-JobControl-2.14.0-Cross-Site-Scripting-SQL-Injection.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.mogwaisecurity.de/advisories/MSA-2014-02.txt"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-012"},{"name":"70155","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/70155"},{"name":"20140925 MSA-2014-02: Typo3 Extension dmmjobcontrol Multiple Vulnerabilities (typo3-ext-sa-2014-012)","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2014/Sep/89"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-09-25T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in the search function in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the (1) education, (2) region, or (3) sector fields, as demonstrated by the tx_dmmjobcontrol_pi1[search][sector][] parameter to jobs/."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-10-10T13:57:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/128446/Typo3-JobControl-2.14.0-Cross-Site-Scripting-SQL-Injection.html"},{"tags":["x_refsource_MISC"],"url":"https://www.mogwaisecurity.de/advisories/MSA-2014-02.txt"},{"tags":["x_refsource_MISC"],"url":"http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-012"},{"name":"70155","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/70155"},{"name":"20140925 MSA-2014-02: Typo3 Extension dmmjobcontrol Multiple Vulnerabilities (typo3-ext-sa-2014-012)","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2014/Sep/89"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-7201","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in the search function in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the (1) education, (2) region, or (3) sector fields, as demonstrated by the tx_dmmjobcontrol_pi1[search][sector][] parameter to jobs/."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://packetstormsecurity.com/files/128446/Typo3-JobControl-2.14.0-Cross-Site-Scripting-SQL-Injection.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/128446/Typo3-JobControl-2.14.0-Cross-Site-Scripting-SQL-Injection.html"},{"name":"https://www.mogwaisecurity.de/advisories/MSA-2014-02.txt","refsource":"MISC","url":"https://www.mogwaisecurity.de/advisories/MSA-2014-02.txt"},{"name":"http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-012","refsource":"MISC","url":"http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-012"},{"name":"70155","refsource":"BID","url":"http://www.securityfocus.com/bid/70155"},{"name":"20140925 MSA-2014-02: Typo3 Extension dmmjobcontrol Multiple Vulnerabilities (typo3-ext-sa-2014-012)","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2014/Sep/89"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-7201","datePublished":"2014-10-10T14:00:00.000Z","dateReserved":"2014-09-26T00:00:00.000Z","dateUpdated":"2024-08-06T12:40:19.058Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-10-10 14:55:09","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:kevin_renskers:dmmjobcontrol:*:*:*:*:*:typo3:*:*","versionEndIncluding":"2.14.0","matchCriteriaId":"83DB6248-22CE-45D5-BA15-9A5915F405AA"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"7201","Ordinal":"1","Title":"CVE-2014-7201","CVE":"CVE-2014-7201","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"7201","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in the search function in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the (1) education, (2) region, or (3) sector fields, as demonstrated by the tx_dmmjobcontrol_pi1[search][sector][] parameter to jobs/.","Type":"Description","Title":"CVE-2014-7201"},{"CveYear":"2014","CveId":"7201","Ordinal":"2","NoteData":"2014-10-10","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"7201","Ordinal":"3","NoteData":"2014-10-10","Type":"Other","Title":"Modified"}]}}}