TYPO3 Powermail Extension 1.6.3 Unspecified SQL Injection Vulnerability

Bugtraq ID:	47799
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 11 2011 12:00AM
Updated:	May 11 2011 12:00AM
Credit:	Reported by vendor.
Vulnerable:	Typo3 Powermail 1.6.2 Typo3 Powermail 1.6.1 Typo3 Powermail 1.6
Not Vulnerable:	Typo3 Powermail 1.6.3

TYPO3 Powermail Extension 1.6.3 Unspecified SQL Injection Vulnerability

The Powermail extension for TYPO3 is prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Powermail 1.6.3 and earlier are vulnerable.

TYPO3 Powermail Extension 1.6.3 Unspecified SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

TYPO3 Powermail Extension 1.6.3 Unspecified SQL Injection Vulnerability

Solution:
Updates are available. Please see the references for more information.

TYPO3 Powermail Extension 1.6.3 Unspecified SQL Injection Vulnerability

References:

• Powermail Homepage (Typo3)
  
• TYPO3 Homepage (TYPO3)
  
• TYPO3 Security Bulletin TYPO3-SA-2011-004: Blind SQL Injection vulnerability in (TYPO3 Association)