PT-2014-7833 · Typo3 · Jobcontrol

Publicado 2014-10-10 · Atualizado 2014-10-22 · CVE-2014-7201

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JobControl (dmmjobcontrol) extension versions 2.14.0 and earlier for TYPO3

Description The issue concerns SQL injection vulnerabilities in the search function of the JobControl extension for TYPO3. These vulnerabilities allow remote attackers to execute arbitrary SQL commands by manipulating the education, region, or sector fields. For example, an attacker could exploit the tx dmmjobcontrol pi1[search][sector][] parameter in the "jobs/" endpoint.

Recommendations For JobControl (dmmjobcontrol) extension versions 2.14.0 and earlier, consider disabling the search function in the affected extension until a patch is available. Restrict access to the vulnerable tx dmmjobcontrol pi1/class.tx dmmjobcontrol pi1.php file to minimize the risk of exploitation. Avoid using the parameters related to the education, region, or sector fields in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-7201

Produtos afetados

Jobcontrol

Referências · 7

• 🔥 https://exploit-db.com/exploits/34800 · Exploit
• 🔥 https://mogwaisecurity.de/advisories/MSA-2014-02.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/128446/Typo3-JobControl-2.14.0-Cross-Site-Scripting-SQL-Injection.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Sep/89 · Exploit
• http://securityfocus.com/bid/70155 · Nota
• http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-012 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-7201 · Nota de Segurança