Webkit PDFs For TYPO3 SQL Injection Vulnerability and Remote Command Execution Vulnerability

Bugtraq ID:	42381
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 11 2010 12:00AM
Updated:	Aug 11 2010 12:00AM
Credit:	Sven Taute
Vulnerable:
Not Vulnerable:

Webkit PDFs For TYPO3 SQL Injection Vulnerability and Remote Command Execution Vulnerability

Webkit PDFs (webkitpdf) for TYPO3 is prone to an unspecified SQL-injection vulnerability and an unspecified remote command-execution vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Webkit PDFs 1.1.4 are vulnerable.

Webkit PDFs For TYPO3 SQL Injection Vulnerability and Remote Command Execution Vulnerability

Attackers can use a browser to exploit these issues.

Webkit PDFs For TYPO3 SQL Injection Vulnerability and Remote Command Execution Vulnerability

Solution:
Updates are available. Please see the references for details.

Webkit PDFs For TYPO3 SQL Injection Vulnerability and Remote Command Execution Vulnerability

References:

• Synnefoims Homepage (synnefoims)
  
• TYPO3 Security Bulletin TYPO3-SA-2010-015: Several vulnerabilities in third part (TYPO3)
  
• Webkit PDFs 1.1.4 (Dev-Team Typoheads)