GHSA-v3mr-gp7j-pw5w Possible SQL injection in tablelookupwizard Contao Extension
An SQL injection vulnerability in the Contao tablelookupwizard extension allows attackers to manipulate database queries via unsanitized widget values.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-v3mr-gp7j-pw5w?
GHSA-v3mr-gp7j-pw5w is a SQL injection vulnerability in terminal42/contao-tablelookupwizard, published on 10 Feb 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.
Patches
The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0.
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/terminal42/contao-tablelookupwizard
- Email us at [email protected]
Which versions are affected by GHSA-v3mr-gp7j-pw5w?
2 open source packages ship an affected version, including terminal42/contao-tablelookupwizard.
| Package | Affected | Fixed in |
|---|---|---|
terminal42/contao-tablelookupwizard Packagist | All versions | 3.3.5 |
terminal42/contao-tablelookupwizard Packagist | All versions | 3.3.5 |
How do I fix GHSA-v3mr-gp7j-pw5w?
Upgrade terminal42/contao-tablelookupwizard to 3.3.5 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is GHSA-v3mr-gp7j-pw5w being exploited?
There is no known exploitation of GHSA-v3mr-gp7j-pw5w in the wild and no public exploit code.