TYPO3 FE address edit for tt_address & direct mail Extension Unspecified SQL Injection Vulnerability

Bugtraq ID:	31259
Class:	Input Validation Error
CVE:	CVE-2008-6458
Remote:	Yes
Local:	No
Published:	Sep 19 2008 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	Clemens Riccabona
Vulnerable:	Dieter Mayer FE address edit for tt_address & direct mail 0.4
Not Vulnerable:

TYPO3 FE address edit for tt_address & direct mail Extension Unspecified SQL Injection Vulnerability

TYPO3 FE address edit for tt_address & direct mail ('dmaddredit') is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects 'dmaddredit' 0.4.0; other versions may also be affected.

TYPO3 FE address edit for tt_address & direct mail Extension Unspecified SQL Injection Vulnerability

Attackers can use a web browser to exploit this issue.

TYPO3 FE address edit for tt_address & direct mail Extension Unspecified SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TYPO3 FE address edit for tt_address & direct mail Extension Unspecified SQL Injection Vulnerability

References:

• Product Homepage (Dieter Mayer)
  
• TYPO3 Homepage (TYPO3)
  
• TYPO3 Collective Security Bulletin TYPO3-20080919-1 (TYPO3)