{"id":"GHSA-4465-r2hg-v4rj","aliases":["CVE-2013-4662"],"title":"CiviCRM SQL injection vulnerability via Quick Search API","description":"The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the \"second layer\" of the API, related to contact.getquick.","severity":"medium","score":null,"published":"2022-05-17T04:52:06.000Z","modified":"2023-11-08T03:57:24.206Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"civicrm/civicrm-core","ranges":[{"events":[{"introduced":"4.2.0"},{"fixed":"4.2.9"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.2.9"]},{"ecosystem":"Packagist","name":"civicrm/civicrm-core","ranges":[{"events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.3.3"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2013-4662","https://civicrm.org/advisory/civi-sa-2013-004-limited-sql-injection-quick-search-api","https://github.com/civicrm/civicrm-core","https://issues.civicrm.org/jira/browse/CRM-12765"],"sources":[{"name":"OSV","id":"GHSA-4465-r2hg-v4rj","modified":"2023-11-08T03:57:24.206289Z","url":"https://osv.dev/vulnerability/GHSA-4465-r2hg-v4rj"}],"assessments":[]}