PT-2019-12345 · Contao · Contao

David Wind · Published 2019-07-09 · Updated 2022-05-24 · CVE-2019-11512

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contao versions prior to 4.4.39 Contao versions prior to 4.7.5

Description The issue allows SQL Injection. A penetration tester discovered that the SQL injection vulnerability can still be exploited in the file manager in Contao 4.

Recommendations For Contao versions prior to 4.4.39, update to Contao 4.4.39 or later. For Contao versions prior to 4.7.5, update to Contao 4.7.5 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-11512

GHSA-VQ59-X6MQ-4WGW

Affected Products

Contao

References · 8

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-11512.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-11512.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2019-11512 · Vendor Advisory
• https://contao.org/en/news/security-vulnerability-cve-2019-11512.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11512 · Security Note
• https://osv.dev/vulnerability/GHSA-vq59-x6mq-4wgw · Vendor Advisory
• https://github.com/contao/contao/commit/87d92f823b08b91a0aeb522284537c8afcdb8aba · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11512 · Note