TYPO3 Fe user statistic Extension Unspecified SQL Injection Vulnerability

Bugtraq ID:	42366
Class:	Input Validation Error
CVE:	CVE-2010-4952
Remote:	Yes
Local:	No
Published:	Aug 11 2010 12:00AM
Updated:	Oct 11 2011 08:30PM
Credit:	Marcus Krause of the TYPO3 Security Team
Vulnerable:
Not Vulnerable:

TYPO3 Fe user statistic Extension Unspecified SQL Injection Vulnerability

The Fe user statistic 'festat' extension for TYPO3 is prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Fe user statistic 0.2.0 and prior are vulnerable.

TYPO3 Fe user statistic Extension Unspecified SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

TYPO3 Fe user statistic Extension Unspecified SQL Injection Vulnerability

Solution:
An update is available. Please see the references for more information.

TYPO3 Fe user statistic Extension Unspecified SQL Injection Vulnerability

References:

• Fe user statistic Homepage (TYPO3)
  
• Synnefoims Homepage (synnefoims)
  
• TYPO3 Security Bulletin TYPO3-SA-2010-015: Several vulnerabilities in third part (TYPO3)