PT-2024-40160 · Unknown · Tablelookupwizard

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: tablelookupwizard versions prior to 3.3.5 tablelookupwizard versions prior to 4.0.0

Description: The issue is related to the sanitization of widget values before they are passed to the database, which could lead to an SQL injection possibility.

Recommendations: For versions prior to 3.3.5, update to version 3.3.5 or later. For versions prior to 4.0.0, update to version 4.0.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-7FPJ-WC8V-9CGC

Affected Products

Tablelookupwizard

References · 5

• https://osv.dev/vulnerability/GHSA-7fpj-wc8v-9cgc · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/terminal42/contao-tablelookupwizard/2022-02-04-1.yaml · Note
• https://github.com/terminal42/contao-tablelookupwizard/security/advisories/GHSA-v3mr-gp7j-pw5w · Note
• https://github.com/terminal42/contao-tablelookupwizard · Note
• https://github.com/terminal42/contao-tablelookupwizard/commit/a5e723a28f110b7df8ffc4175cef9b061d3cc717 · Note