Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
TYPO3 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2019-19850 - Vulnerability Database
TYPO3

TYPO3 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability - CVE-2019-19850

High
Reference: CVE-2019-19850
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-19850
Title: TYPO3 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability
Overview:

An issue was discovered in TYPO3 before 8.7.30 9.x before 9.5.12 and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed and a valid backend user who has administrator privileges.