TYPO3 Kitchen recipe Extension Unspecified SQL Injection Vulnerability

Bugtraq ID:	51825
Class:	Input Validation Error
CVE:	CVE-2012-1071
Remote:	Yes
Local:	No
Published:	Feb 02 2012 12:00AM
Updated:	Feb 16 2012 05:50PM
Credit:	Raphael Noailles
Vulnerable:	Mathieu Vidal Kitchen recipe 0.4
Not Vulnerable:	Mathieu Vidal Kitchen recipe 0.4.1

TYPO3 Kitchen recipe Extension Unspecified SQL Injection Vulnerability

The Kitchen recipe extension for TYPO3 is prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Kitchen recipe 0.4.0 and prior are vulnerable.

TYPO3 Kitchen recipe Extension Unspecified SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

TYPO3 Kitchen recipe Extension Unspecified SQL Injection Vulnerability

Solution:
An update is available. Please see the references for more information.

TYPO3 Kitchen recipe Extension Unspecified SQL Injection Vulnerability

References:

• Synnefoims Homepage (synnefoims)
  
• Kitchen recipe Homepage (Mathieu Vidal)
  
• TYPO3 Security Bulletin TYPO3-EXT-SA-2012-001: Several vulnerabilities in third (Typo3)