Typo3 CVE-2010-5103 SQL-Injection Vulnerability

Bugtraq ID:	73521
Class:	Input Validation Error
CVE:	CVE-2010-5103
Remote:	Yes
Local:	No
Published:	May 21 2012 12:00AM
Updated:	May 21 2012 12:00AM
Credit:	Unknown
Vulnerable:	Typo3 Typo3 4.4.2 Typo3 Typo3 4.3.3 Typo3 Typo3 4.3.2 Typo3 Typo3 4.3.1 Typo3 Typo3 4.3 Typo3 Typo3 4.2.12 Typo3 Typo3 4.2.11 Typo3 Typo3 4.2.10 Typo3 Typo3 4.2.9 Typo3 Typo3 4.2.6 Typo3 Typo3 4.2.4 Typo3 Typo3 4.2.3 Typo3 Typo3 4.2.2 Typo3 Typo3 4.2.1 Typo3 Typo3 4.2 Typo3 Typo3 4.4.4 Typo3 Typo3 4.4.3 Typo3 Typo3 4.4.1 Typo3 Typo3 4.3.8 Typo3 Typo3 4.3.7 Typo3 Typo3 4.3.6 Typo3 Typo3 4.3.5 Typo3 Typo3 4.3.4 Typo3 Typo3 4.2.8 Typo3 Typo3 4.2.7 Typo3 Typo3 4.2.5 Typo3 Typo3 4.2.15 Typo3 Typo3 4.2.14 Typo3 Typo3 4.2.13
Not Vulnerable:

Typo3 CVE-2010-5103 SQL-Injection Vulnerability

Typo3 is prone to a sql-injection vulnerability. SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.

Typo3 CVE-2010-5103 SQL-Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Typo3 CVE-2010-5103 SQL-Injection Vulnerability

References:

• http://www.securityfocus.com/bid/45470 (BID)
  
• IBM X-Force Exchange Beta (XF)
  
• Multiple vulnerabilities in TYPO3 Core - - TYPO3 - The Enterprise Open Source C (CONFIRM)
  
• oss-security - CVE requests: ftpls, xdigger, lbreakout2, calibre, typo3 (MLIST)
  
• oss-security - CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE (MLIST)
  
• oss-security - Re: CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE (MLIST)
  
• oss-security - Re: CVE-request: TYPO3 TYPO3-SA-2010-022 still without CVE (MLIST)