GHSA-v3mr-gp7j-pw5wcritical9.8
Possible SQL injection in tablelookupwizard Contao Extension
No CVE assignedCheck your stack
The advisory, in context
Impact
The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.
Patches
The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0.
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/terminal42/contao-tablelookupwizard
- Email us at info@terminal42.ch
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
terminal42/contao-tablelookupwizard Packagist
Ecosystem versions
Earlier releases before 3.3.5
Fixed in 3.3.5
13 explicitly affected versions
2.0.1, 3.0.0, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.1",
"3.0.0",
"3.1.0",
"3.1.1",
"3.1.2",
"3.1.3",
"3.2.0",
"3.2.1",
"3.3.0",
"3.3.1",
"3.3.2",
"3.3.3",
"3.3.4"
]
}References
- https://github.com/terminal42/contao-tablelookupwizard/security/advisories/GHSA-v3mr-gp7j-pw5w
- https://github.com/terminal42/contao-tablelookupwizard/commit/a5e723a28f110b7df8ffc4175cef9b061d3cc717
- https://github.com/FriendsOfPHP/security-advisories/blob/master/terminal42/contao-tablelookupwizard/2022-02-04-1.yaml
- https://github.com/terminal42/contao-tablelookupwizard