TYPO3 Tiny Market (hm_tinymarket) Unspecified SQL Injection and Code Execution Vulnerabilities

Bugtraq ID:	42943
Class:	Unknown
CVE:	CVE-2010-4888 CVE-2010-4889
Remote:	Yes
Local:	No
Published:	Sep 02 2010 12:00AM
Updated:	Oct 11 2011 08:50PM
Credit:	Roland Obermayer and Kerstin Schützwohl
Vulnerable:	Typo3 Tiny Market 0.5.4
Not Vulnerable:

TYPO3 Tiny Market (hm_tinymarket) Unspecified SQL Injection and Code Execution Vulnerabilities

The TYPO3 Tiny Market (hm_tinymarket) extension is prone to an unspecified SQL-injection vulnerability and an unspecified code-execution vulnerability.

Exploiting these issues could allow an attacker to execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Tiny Market 0.5.4 are vulnerable.

TYPO3 Tiny Market (hm_tinymarket) Unspecified SQL Injection and Code Execution Vulnerabilities

Attackers can use a browser to exploit an SQL injection vulnerability.

TYPO3 Tiny Market (hm_tinymarket) Unspecified SQL Injection and Code Execution Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TYPO3 Tiny Market (hm_tinymarket) Unspecified SQL Injection and Code Execution Vulnerabilities

References:

• Synnefoims Homepage (synnefoims)
  
• TYPO3 Security Bulletin TYPO3-SA-2010-018: Several vulnerabilities in third part (TYPO3)