PT-2014-7833 · Typo3 · Jobcontrol

Published 2014-10-10 · Updated 2014-10-22 · CVE-2014-7201

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JobControl (dmmjobcontrol) extension versions 2.14.0 and earlier for TYPO3

Description The issue concerns SQL injection vulnerabilities in the search function of the JobControl extension for TYPO3. These vulnerabilities allow remote attackers to execute arbitrary SQL commands by manipulating the education, region, or sector fields. For example, an attacker could exploit the tx dmmjobcontrol pi1[search][sector][] parameter in the "jobs/" endpoint.

Recommendations For JobControl (dmmjobcontrol) extension versions 2.14.0 and earlier, consider disabling the search function in the affected extension until a patch is available. Restrict access to the vulnerable tx dmmjobcontrol pi1/class.tx dmmjobcontrol pi1.php file to minimize the risk of exploitation. Avoid using the parameters related to the education, region, or sector fields in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-7201

Affected Products

Jobcontrol

References · 7

• 🔥 https://exploit-db.com/exploits/34800 · Exploit
• 🔥 https://mogwaisecurity.de/advisories/MSA-2014-02.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/128446/Typo3-JobControl-2.14.0-Cross-Site-Scripting-SQL-Injection.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Sep/89 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-7201 · Security Note
• http://securityfocus.com/bid/70155 · Note
• http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-012 · Note