Donald Lobo

**Name of the Vulnerable Software and Affected Versions** CiviCRM versions 2.0.0 through 4.2.9 CiviCRM versions 4.3.0 through 4.3.3 **Description** The issue is related to the improper enforcement of role-based access control (RBAC) restrictions for default custom searches. This allows remote authenticated users with the `access CiviCRM` permission to bypass intended access restrictions. For example, they can access custom contribution data without having the `access CiviContribute` permission. **Recommendations** For CiviCRM versions 2.0.0 through 4.2.9, update to a version that properly enforces RBAC restrictions. For CiviCRM versions 4.3.0 through 4.3.3, update to a version that properly enforces RBAC restrictions. As a temporary workaround, consider restricting the `access CiviCRM` permission to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CiviCRM versions prior to 4.2.12 CiviCRM versions 4.3.x prior to 4.3.7 CiviCRM versions 4.4.x prior to 4.4.beta4 **Description** The issue allows remote attackers to execute arbitrary SQL commands via the ` value` parameter to (1) "ajax/jqState" or (2) "ajax/jqcounty" API endpoints. This is a result of multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php. **Recommendations** For versions prior to 4.2.12, update to version 4.2.12 or later. For versions 4.3.x prior to 4.3.7, update to version 4.3.7 or later. For versions 4.4.x prior to 4.4.beta4, update to version 4.4.beta4 or later. As a temporary workaround, consider restricting access to the "ajax/jqState" and "ajax/jqcounty" API endpoints until a patch is applied. Avoid using the ` value` parameter in the affected API endpoints until the issue is resolved.