GHSA-jpwx-ffjq-wr4w Content object state fetch functions open to SQL injection
SQL injection in eZ Publish Legacy content object state functions allows attackers to read or modify database data.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not stated
- Fix
- Available
What is GHSA-jpwx-ffjq-wr4w?
GHSA-jpwx-ffjq-wr4w is a SQL injection vulnerability in ezsystems/ezpublish-legacy, published on 7 Sep 2021. It can be exploited over the network.
Official description
Impact
This Security Update is about a vulnerability in eZ Publish Legacy. The content object state code could be vulnerable to SQL injection. There is no known exploit, but one might be possible. If you use Legacy in any way, we strongly recommend that you install this update as soon as possible.
Patches
The fix is distributed via Composer, see "Patched versions".
Which versions are affected by GHSA-jpwx-ffjq-wr4w?
4 open source packages ship an affected version, including ezsystems/ezpublish-legacy.
| Package | Affected | Fixed in |
|---|---|---|
ezsystems/ezpublish-legacy Packagist | All versions | 2017.12.7.4 |
ezsystems/ezpublish-legacy Packagist | All versions | 2017.12.7.4 |
ezsystems/ezpublish-legacy Packagist | From 2018.06.0 | 2019.03.6.1 |
ezsystems/ezpublish-legacy Packagist | From 2018.06.0 | 2019.03.6.1 |
How do I fix GHSA-jpwx-ffjq-wr4w?
Upgrade ezsystems/ezpublish-legacy to a fixed version for your release line: 2017.12.7.4 or 2019.03.6.1.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is GHSA-jpwx-ffjq-wr4w being exploited?
There is no known exploitation of GHSA-jpwx-ffjq-wr4w in the wild and no public exploit code.